The Republican Governors Association (RGA) revealed in data breach notification letters sent last week that its servers were breached during an extensive Microsoft Exchange hacking campaign that hit organizations worldwide in March 2021.
Following an investigation started after March 10, "RGA determined that the threat actors accessed a small portion of RGA’s email environment between February 2021 and March 2021, and that personal information may have been accessible to the threat actor(s) as a result."
Even though the RGA said that, at first, it wasn't able if any personal information was impacted as a result of this incident, a subsequent "thorough data mining effort to identify potentially impacted individuals" revealed that names, Social Security numbers, and payment card information were exposed in the attack.
RGA discovered that individuals affected by this data breach had their personal information exposed on June 24 and completed its "data mining" efforts on September 1.
"Once potentially impacted individuals were identified, RGA worked to identify addresses and engage a vendor to provide call center, notification, and credit monitoring services," RGA told impacted individuals in a breach letter sent on September 15.
"RGA is also offering you two (2) years of complimentary credit monitoring and identity restoration services with Experian. RGA has also notified the Federal Bureau of Investigation, certain state regulators, and the consumer reporting agencies of this incident as required."
A Republican Governors Association spokesperson was not available for comment when contacted by BleepingComputer earlier today.
Abused for data theft, to deploy ransomware and cryptominers
The massive scale hacking campaign RGA refers to in its data breach notification letter targeted more than a quarter of a million Microsoft Ex ..
Support the originator by clicking the read the rest link below.
