IE 11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Employee Data Exposed After North Dakota Phishing Attack

A Workforce Safety & Insurance employee opened a malicious email attachment — an incident that led to cyber attackers accessing personal data on 182 individuals who had been seeking injured employee claims.

Digital illustrations of email inbox icons in the foreground overlayed on an image of hands typing on a laptop.
Cyber attackers appear to have accessed personal data on 182 injured employees, North Dakota’s department of Workforce Safety & Insurance (WSI) announced Friday, Aug. 19.

The incident occurred on June 28, when a WSI employee opened a malicious email attachment. The successful phishing attempt let attackers access information in the recipient’s emails and voicemails. Those messages included personal details related to processing 182 individuals’ injured employee claims, and the agency reached out to notify the affected individuals, WSI said in an FAQ about the incident.

“These emails contained information received and sent by a claims adjustor to process injured employee claims including emails to and from WSI employees and business partners,” the agency stated. “We know that the attackers had access to personal information in the emails. We cannot verify what information was actually taken because of the attacker’s use of anti-forensic techniques. It is unknown how the attackers will use the information.”

The state was able to detect the incident in time to contain the damage.

After opening the malicious attachment, the WSI employee detected “unusual activity” on their computer and informed the WSI Help Desk. Their computer was then “secured and removed from the state network,” and WSI connected with the North Dakota Information Technology (NDIT) Cyber Analysis and Response team, which conducted a forensic analysis of the impacted device, WSI said.

NDIT determined that the rest of the state network was spared from the attack, which did not spread beyond the initial computer.

WSI said it is offering impacted employees 12 months of identity theft protection, fully managed identity theft recovery services and a $1 million insurance reimbursement policy for identity theft losses. Data breach and recovery services firm IDX is providing these services.