https://sao.wa.gov/breach2021/ skip to main content * Breach 2021 * The Audit Connection Blog * Coronavirus * Public Records + About Public Records + Public Records Request Responses * Client Login * Facebook# * Twitter# * LinkedIn# * YouTube# Office of the Washington State Auditor WSAO logo [ ] [Search] * Reports & Data + Report Types + Explore Governments That Serve You + Audit Reports + Tracker + Financial Intelligence Tool (FIT) + Performance Reports + Whistleblower & Fraud Reports + Other Annual Reports * Performance Audits + Featured Performance Audit Report + About Performance Audits + Search Performance Reports + Performance Audits in Progress * About Audits + Anatomy of an Audit + About State Government Audits + About Local Government Audits + About IT Audits + About Performance Audits + Find Your Audit Team + The Audit Dispute Process + COVID-19 Guidance Toolkit * Improving Government + The Center for Government Innovation + Resources Database + #BeCyberSmart + #Gov101 + Improvement Training Videos + Preventing Fraud * BARS & Annual Filing + BARS GAAP Manual + BARS Cash Manual + Accounting Delays + COVID-19 Accounting and Reporting + Leases + Cash Basis Other Postemployment Benefits (OPEB) + Looking Forward to Cash BARS + BARS Reporting Templates + BARS & Annual Report Filing FAQs + Training and Workshops + Local Government Advisory Committee * Report a Concern + How to Report a Concern + About the Accellion data security breach + The Citizen Hotline + Fraud Program + Whistleblower Program + Whistleblower FAQs * About SAO + What We Do + State Auditor Pat McCarthy + Legislative Priorities + Leadership at SAO + Office Locations + Sign Up for News & Alerts + Contact SAO + Who Audits the Auditor + Careers at SAO * Breach 2021 * The Audit Connection Blog * Coronavirus * Public Records + About Public Records + Public Records Request Responses * Client Login * Facebook# * Twitter# * LinkedIn# * YouTube# SAO Home/ About the Accellion data security breach About the Accellion data security breach * How to Report a Concern * About the Accellion data security breach * The Citizen Hotline * Fraud Program * Whistleblower Program * Whistleblower FAQs What you need to know The information on this page was last updated: 02/01/2021 8:45 AM The Office of the Washington State Auditor ("SAO") was recently made aware of a security breach involving Accellion, a third party provider of hosted file transfer services. During the week of January 25, 2021, Accellion confirmed that an unauthorized person gained access to SAO files by exploiting a vulnerability in Accellion's file transfer service. Some of the SAO data files contained personal information of Washington state residents who filed unemployment insurance claims in 2020. The compromised files may also include the personal information of other Washington residents who have not yet been identified but whose information was in state agency or local government files under review by the SAO. This matter is under ongoing investigation by SAO. SAO is committed to providing timely and accurate information about what happened and who is affected when available, as permitted and appropriate. As such, this page will be updated from time to time on the SAO website as SAO obtains additional information. What happened: SAO is advised that an unauthorized person was able to exploit a software vulnerability in Accellion's file transfer service and gain access to files that were being transferred using Accellion's service. Accellion stated that they believe the unauthorized access occurred in late December of 2020. Other customers of this Accellion service were similarly impacted. SAO is currently seeking a full understanding of the timeline of the incident and the status of Accellion's investigation and the investigation by law enforcement. At this time, SAO does not have enough information to draw conclusions about the timing or full scope of what took place. It was not until the week of January 25, 2021, that Accellion confirmed to SAO that SAO files were subject to this attack and provided the information needed for SAO to begin to identify which data files were impacted and individuals whose personal information is in those files. What information was involved? The data files are voluminous and SAO is in the process of reviewing the impacted files to identify the types of data, agencies, and individuals involved. SAO will provide updates about the types of information involved as soon as that information becomes available through the investigation. At this time, SAO has determined that data files from the Employment Security Department (ESD) were impacted. These ESD data files contained unemployment compensation claim information including the person's name, social security number and/or driver's license or state identification number, bank account number and bank routing number, and place of employment. Data files from some local governments and other state agencies were also affected. SAO is diligently reviewing all potentially accessed data files to identify which agencies' and local governments' files were impacted and to determine whether those data files contained personal information. SAO will provide updates on these efforts and notify the individuals, agencies, and local governments as soon as possible. Resources SAO will provide: SAO will make resources available to help each affected individual take measures to protect their identity. SAO is currently in the process of arranging for such services and will post that information as soon as it is available. Resources you can use to help protect your identity: If you believe that your information may have been contained within SAO's files, you can also take other actions to reduce the chances of identity theft or fraud on your accounts, including reviewing your account statements and credit reports, notifying your financial institutions of any suspicious activity, and promptly reporting any suspected incidents of identity theft to law enforcement, the state attorney general, and/or the Federal Trade Commission. Free Credit Report - You may also obtain a free copy of your credit report from each of the three major credit reporting agencies once every 12 months by visiting http://www.annualcreditreport.com/, calling toll-free 877-322-8228 or by completing an Annual Credit Report Request form and mailing it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta GA 30348. You can also contact one of the national credit reporting agencies: Equifax Experian TransUnion Free Annual Report P.O. Box 105851 P.O. Box 9532 P.O. Box 1000 P.O. Box 105281 Atlanta, GA Allen, TX 75013 Chester, PA 19016 Atlanta, GA 30348 30348 1-888-397-3742 1-877-322-8228 1-877-322-8228 1-800-525-6285 www.experian.com www.transunion.com annualcreditreport.com www.equifax.com Fraud Alert - You may want to consider placing a fraud alert on your credit report. An initial fraud alert is free and will stay on your credit file for at least 90 days. The alert informs creditors of possible fraudulent activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact any of the three credit reporting agencies identified above. Additional information is available at http://www.annualcreditreport.com. Credit Freeze - In some states, you have the right to put a security freeze on your credit file. This will prevent new credit from being opened in your name without the use of a PIN that is issued to you when you initiate the freeze. A security freeze is designed to prevent potential creditors from accessing your credit report without your consent. As a result, using a security freeze may interfere with or delay your ability to obtain credit. You must separately place a security freeze on your credit file with each credit reporting agency. There is no fee to place, lift, or remove the security freeze. In order to place a security freeze, you may be required to provide the consumer reporting agency with information that identifies you, including your full name, Social Security number, date of birth, current and previous addresses, a copy of your state-issued identification card, and a recent utility bill, bank statement or insurance statement. Federal Trade Commission - You can obtain information from the consumer reporting agencies, the Federal Trade Commission (FTC), or from the Attorney General about steps you can take toward preventing identity theft. You may report suspected identity theft to local law enforcement, including to the FTC or to the Attorney General in your state. Here is the contact information for the FTC: Federal Trade Commission 600 Pennsylvania Ave, NW Washington, DC 20580 www.consumer.ftc.gov www.identitytheft.gov www.ftc.gov/idtheft 1-877-438-4338 SAO takes cyber security very seriously and appreciates your patience as the investigation continues. Updates to this notice will be posted on this website as SAO learns additional information that may help you with this unfortunate situation. Reports & Data * Report Types * Explore Governments That Serve You * Audit Reports * Financial Intelligence Tool (FIT) * Tracker * Performance Reports * Whistleblower & Fraud Reports * Other Annual Reports Performance Audits * Featured Performance Audit Report * About Performance Audits * Search Performance Reports * Performance Audits in Progress About Audits * Anatomy of an Audit * About State Government Audits * About Local Government Audits * About IT Audits * About Performance Audits * Find Your Audit Team * The Audit Dispute Process * COVID-19 Guidance Toolkit Improving Government * The Center for Government Innovation * Learn to be Lean * Access Advice * #BeCyberSmart * #Gov101 * Resources Database * Improvement Training Videos * Preventing Fraud BARS & Annual Filing * BARS GAAP Manual * BARS Cash Manual * Accounting Delays * COVID-19 Accounting and Reporting * Leases * Cash Basis Other Postemployment Benefits (OPEB) * Looking Forward to Cash BARS * BARS Reporting Templates * BARS & Annual Report Filing FAQs * Training and Workshops * Local Government Advisory Committee Report a Concern * How to Report a Concern * About the Accellion data security breach * The Citizen Hotline * Fraud Program * Whistleblower Program * Whistleblower FAQs About SAO * What We Do * State Auditor Pat McCarthy * Leadership at SAO * Office Locations * Sign Up for News & Alerts * Contact SAO * Who Audits the Auditor * Careers at SAO Careers * Careers at SAO * Current Openings and Internships * Benefits and Job Descriptions * Contract for the State Auditor Public Records * About Public Records * Public Records Request Responses Connect * The Audit Connection Blog * Sign Up for News & Alerts * Client Login * Facebook[face] * Twitter[twit] * Linkedin[1748] * YouTube[down] Employee Logins * For Employees: ESS Legal * Sitemap * Privacy Policy