Officials observed suspicious activity Oct. 7 on the agency's network and took immediate steps to address the breach, such as contacting law enforcement and third-party experts, the Dec. 4 letter says.
The letter indicates the agency doesn't know the extent of the exposure and whether the intruder pilfered anyone's information, but notes data theft can't be ruled out.
"In an abundance of caution, we wanted to make you aware of the incident, since some of your information could have been involved, such as your name, address, Social Security number, and other identifying information," the letter said.
It goes on to say the agency is working with law enforcement and cybersecurity experts to investigate the breach, and the agency is confident any unauthorized access has been isolated and mitigated.
The agency processes and oversees a wide range of professional licenses, from medical and financial services to construction, food vending and cannabis operations.
In an email, agency spokeswoman Bernice Geiger wrote a system analysis revealed the hacker might have gained access to information related to about 40 percent of licensees' records.
That's roughly 225,000 of the agency's half-million accounts.
The department has hired Advanced Network Management to provide technical assistance in responding to the breach, she wrote.
It also has enlisted the help of Experian to offer a credit-monitoring service to licensees and the agency's employees, Geiger added.
Membership in the service goes for 12 months, and users can activate it with the access code provided in the letter. The deadline for enrolling is March 31.
A call center has been set up to answer questions about the service and can be reached at 833-550-4100.
The agency doesn't plan to change or replace people's license numbers in response to the breach, Geiger wrote, noting professional license numbers are public record in New Mexico.
Anyone who discovers someone has attempted to unlawfully use their license number should immediately report it to the agency and local law enforcement, she wrote.
So far, the agency's day-to-day work hasn't been disrupted by the breach, Geiger wrote.
"The department remains fully operational despite the cyber incident and the ongoing investigation," she wrote. "Our staff is working diligently to process and complete all license applications and renewals as quickly as possible."
© 2022 The Santa Fe New Mexican (Santa Fe, N.M.). Distributed by Tribune Content Agency, LLC.
