State housing agency hacked; email data compromised

Posted at 12:50 p.m. on October 11, 2019 The Brillion News MADISON – The Wisconsin Housing and Economic Development Authority (WHEDA) announced that an unauthorized third party accessed up to three WHEDA email accounts and may have potentially gained access to personal information of an estimated 2,100 Wisconsinites in WHEDA’s single family mortgage program. WHEDA Executive Director Joaquín Altoro said an investigation confirmed that the unauthorized third party gained entry into the WHEDA email accounts through a phishing attack. As a result of the attack, the unauthorized third party obtained WHEDA user credentials, which may have allowed unauthorized access to personal information for some WHEDA customers who applied for single family loans. Altoro said the incident occurred on or around Thursday August 22 and was discovered early the following Monday morning, August 26. Upon learning of the incident, WHEDA’s IT personnel disabled access to the compromised email accounts and began an investigation. In addition, Altoro said WHEDA alerted law enforcement officials about the incident and brought in forensic IT experts to examine the situation, determine how it happened and review the potential extent of the impact. “This is the first time this has ever happened at WHEDA, and we take this very seriously. We already invest significantly in information technology security and staff training, and we will be doing more of it in the future,” he said. “We regret that this happened and will work with those affected to reduce any chances for negative impacts.” Altoro said it is possible that the unauthorized third party gained access to a range of customer information, such as names, social security numbers, driver’s license number or state identification number, and bank account numbers. To date, WHEDA is not aware of any misuse of customer information as a result of this incident. Altoro said WHEDA will provide one year of identity theft protection and insurance as well as credit monitoring at no charge to impacted customers through Experian IdentityWorksSM. He said that WHEDA also has established a toll-free telephone line through Experian for customers to call with questions – 1-833-704-9390. He noted that WHEDA has reached out to all impacted customers with additional information and is also briefing the various financial institutions that participate in the WHEDA single family mortgage program. Altoro noted that WHEDA has an information security program that is audited annually by an outside expert and includes a yearly internal security review of computer operating systems as well as regular employee training. He also said there are regular investments in IT security upgrades, new hardware and software improvements.