Personally identifiable information of 6,367,467 users from 10 states was exposed when America's JobLink Alliance Technical Support was breached Credit: Thinkstock When a Kansas Department of Commerce data system was breached back in March, a hacker accessed more than 5,561,803 Social Security numbers from 10 states, as well as personally identifiable information (PII) from another 805,664 user accounts without SSNs. In total, 6,367,467 users’ information was exposed to the hacker. Those numbers were obtained by the Kansas News Service via an open records request.Have you ever looked for a job via the online portal America’s Job Link Alliance (AJLA)? You might better recognize it under other names; Kansasworks.com is just one example. Workforce services in various states had contracts with the Kansas database contractor AJLA-TS (America’s Job Link Alliance Technical Support). Did you know AJLA says it retains the PII of job seekers unless specifically asked for it to be deleted? If you found a job via AJLA, then it might be wise to ask for your data to be deleted.AJLA-TS admitted in a press release in March that a malicious third-party “hacker” exploited a vulnerability in the AJL code and was able to access millions of users’ information.The actual hack occurred in February, but it wasn’t discovered until March. AJLA admitted, “On February 20, 2017, a hacker created a job seeker account in an America’s JobLink (AJL) system. The hacker then exploited a misconfiguration in the application code to gain unauthorized access to certain information of other job seekers.” The code misconfiguration had been hanging around since October 2016. The suspicious activity was discovered on March 12 and eliminated on March 14; the FBI was contacted on March 15.The PII exposed included users’ names, Social Security numbers, dates of birth and so forth. Kansas was managing the data for 16 states at the time of the hack, but it claimed the following 10 states were affected: Alabama, Arkansas, Arizona, Delaware, Idaho, Illinois, Kansas, Maine, Oklahoma and Vermont. The numbers of victims’ SSNs first reported to be affected by the AJLA-TS hack don’t match up exactly with affected users’ SSNs that were obtained by the Kansas News Service. The real numbers of affected individuals are slightly lower:Alabama: 1,393,109 SSNs exposedArkansas: 597,374 SSNs exposedArizona: 896,370 SSNs exposedDelaware: 236,134 SSNs exposedIdaho: 170,517 SSNs exposedIllinois: 807,450 SSNs exposedKansas: 563,568 SSNs exposedMaine: 283,449 SSNs exposedOklahoma: 430,679 SSNs exposedVermont: 183,153 SSNs exposed“Across these 10 states, another 805,664 user accounts without SSNs were also affected.”Although AJLA is required to ask users for SSNs, not everyone provides it. Most likely enter it because they believe it is required.In May, Kansas Department of Commerce sent about 260,000 emails to Kansas’ 563,568 victims. KCUR said the rest were not contacted because the department claimed it didn’t have email addresses for all affected users and it is not required by law to call or send snail mail to victims.Kansas agreed to pay for a year of credit monitoring services for affected victims in nine states; users in Delaware are eligible for three years of credit monitoring services.You don’t have long to take advantage of the offer as KCUR reported, “The call center for victims, which can be reached at (844) 469-3939, will remain open through the end of this month.”That leaves affected users about a week to take action. Related content news Dow Jones watchlist of high-risk businesses, people found on unsecured database A Dow Jones watchlist of 2.4 million at-risk businesses, politicians, and individuals was left unprotected on public cloud server. By Ms. Smith Feb 28, 2019 4 mins Data Breach Hacking Security news Ransomware attacks hit Florida ISP, Australian cardiology group Ransomware attacks might be on the decline, but that doesn't mean we don't have new victims. A Florida ISP and an Australian cardiology group were hit recently. By Ms. Smith Feb 27, 2019 4 mins Ransomware Security news Bare-metal cloud servers vulnerable to Cloudborne flaw Researchers warn that firmware backdoors planted on bare-metal cloud servers could later be exploited to brick a different customer’s server, to steal their data, or for ransomware attacks. By Ms. Smith Feb 26, 2019 3 mins Cloud Computing Security news Meet the man-in-the-room attack: Hackers can invisibly eavesdrop on Bigscreen VR users Flaws in Bigscreen could allow 'invisible Peeping Tom' hackers to eavesdrop on Bigscreen VR users, to discreetly deliver malware payloads, to completely control victims' computers and even to start a worm infection spreading through VR By Ms. Smith Feb 21, 2019 4 mins Hacking Vulnerabilities Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe