State officials investigate April data breach of Kentucky's online unemployment

Photo: WKYT/Phil Pendleton
Photo: WKYT/Phil Pendleton(WKYT)
Published: May. 29, 2020 at 11:39 AM EDT
Email This Link
Share on Pinterest
Share on LinkedIn

Kentucky’s unemployment system will soon be under a new cabinet.

This after a data breach in the system was announced during Governor Beshear’s 5 p.m. briefing on Thursday.

Josh Benton, with the Kentucky Workforce Development Cabinet, said officials were made aware of a potential vulnerability around 9:15 a.m. on April 23 in the online unemployment portal. Benton says the person who reported it informed officials they could see identity verification documents by other unemployment claimants.

The portal was taken down at 11:30 a.m. that day to prevent other problems. By noon, technicians made a temporary fix to prevent others from viewing documents. The breach was resolved around midnight.

Officials believe the documents were only viewed by other UI claimants and not by anyone outside the system. They also say only a limited number of people would have experienced this.

Benton says there’s been an ongoing technology investigation to ensure the security of the system. He also says potential problems for people filing claims were very limited.

“I think it’s important to know for those who did file a claim for unemployment insurance, that this revealing of data could have only happened for individuals uploading identity documents, and would have been for prior to April 23. Identity documents move through the system and are not always there at the same time,” says Benton.

Benton says all the major crediting reporting agencies were made aware of the breach. If you were a possible victim, you will be getting notified by the state. Governor Beshear also said there is no indication anyone has been or will be financially harmed.

Beshear also said it took too long for the breach to be announced publically. He says an inspector general from the Transportation Cabinet will be investigating the incident.

Governor Beshear says they will send out numerous notices to possible victims of the breach, but even of those, it’s likely very few people had their information seen.