State of Maine MOVEit Breach Exposes 1.3M People's Data
“This incident was specific and limited to Maine’s MOVEit server and did not impact any other state networks or systems,” officials said.
The type of data affected varies from person to person, and individuals who may have been affected should call special call centers to find out whether they were affected and, if so, what kinds of data might be involved, officials added.
Contact information for the call centers is available on the security incident website.
Maine took steps to block access to its MOVEit server and implement other security measures as soon as it learned about the breach, officials said.
The state also hired outside lawyers and outside cybersecurity experts to help it investigate the nature and scope of the incident.
The state is offering two years of free credit monitoring and identity theft protection services to individuals whose Social Security numbers or taxpayer identity numbers were involved.
The timing: Maine requires state-regulated entities affected by data breaches to report the breaches, and the state’s Office of the Maine Attorney General runs a breach reporting site that has given MOVEit breach observers comprehensive information about the number of organizations and people affected.
A person subject to the breach notification rules must notify Maine about a breach “no more than 30 days after the person … becomes aware of a breach of security and identifies its scope,” according to the statute.
Maine announced the breach affecting the Maine MOVEit server 162 days, and 112 business days, after May 31.
Maine talks about the timing of the announcement in a security incident website section with the heading, “Why Am I Hearing About This Now?”
“The state of Maine carried out an extensive evaluation to identify the individuals whose information may have been impacted,” according to the site. “This thorough assessment was a critical component of Maine’s response, as it facilitated the state in providing notifications to those who may have been affected. This assessment of the impacted files was recently completed, and, as a result, the state is now actively notifying the impacted individuals through various communication channels, including through a nationwide media press release, letter mail and/or email.”
The Portland Breakwater Light in South Portland, Maine, helps guide ships through Portland Harbor. Credit: Jane/Adobe Stock
