NEW HAVEN, CT – The City of New Haven and New Haven Board of Education announced today that it is sending letters to individuals who may have been included in a data privacy incident involving some of their personal information, stemming from a previously disclosed Business Email Compromise cyberattack that occurred in June 2023.
At that time, the City identified suspicious activity on email accounts belonging to City employees. Upon discovering this activity, the City began an internal investigation and engaged a forensic investigation firm to investigate. The forensic investigation found unauthorized access to City email accounts containing personal information from June 1, 2023 through June 18, 2023. The City then engaged an e-discovery firm to search the email accounts for any personal information that could have been viewed during the period of unauthorized access. The City’s investigation subsequently determined that personal information belonging to 404 individuals could have been accessed. These individuals include city employees, retirees, vendors, and others. The accessible information varied by individual, but included names, dates of birth, Social Security numbers, driver’s license numbers, financial account numbers, individual tax identification numbers, health insurance information, and/or medical information.
At this point, the City is not aware of any fraud or identity theft to any individual as a result of this incident, but nonetheless is notifying potentially involved individuals to provide them with more information and resources. The notice includes information on steps individuals can take to protect themselves against potential fraud as well as complimentary one-year membership to an identify protection and credit monitoring services firm. Letters are being mailed to 334 individuals for which the city has contact information, and a notice is being posted on the City’s website in an effort to help alert 70 individuals for whom the City does not have contact information. Impacted individuals seeking additional information may call a confidential, toll-free inquiry line at 888-326-0947 from 9 am to 9 pm EST, Monday – Friday excluding major U.S. holidays.
“The intent of these criminals was to steal money from New Haven Public School students. Fortunately, with the help of our law enforcement partners, we’ve been able to recover most of those funds. However, during this cyberattack, these criminals also had the potential to access personal information of individuals. Thankfully, the City is not aware of any identify theft or fraud stemming from this exposure of information. Out of an abundance of caution we want to notify the individuals involved to ensure they are aware and can take the necessary steps to protect themselves and their information,” said Mayor Justin Elicker. “Unfortunately, we live in a world where there are bad actors who seek to prey upon and steal from innocent people. We have taken many steps to strengthen our systems since this incident and will continue to improve our systems to help reduce the likelihood of an incident like this happening again.”
The City has recovered or is scheduled to receive approximately $5.1 million of the approximately $6 million in stolen funds.
Since then, the City has hired a Chief Technology Officer to strengthen collaboration between New Haven Public Schools and other City IT functions, and to improve its cybersecurity posture. Additionally, the City has engaged several outside companies that have reviewed its cybersecurity and financial procedures and are working with the City to implement these improvements.
In general, the City recommends that individuals regularly monitor credit reports, account statements and benefit statements. If individuals detect any suspicious activity, they should notify the entity with which the account is maintained, and promptly report any fraudulent activity to proper law enforcement authorities, including the police and the state attorney general.
###
PRESS CONTACTS:
