State courts office hacked; breach fixed

The Associated PressMay 10, 2013 

  • WHO IS POTENTIALLY AFFECTED

    The Washington State Administrative Office of the Courts announced Thursday that a data breach occurred recently on its public website. Individuals meeting the following criteria could potentially be affected by the breach:

    Social security numbers

    If you were booked into a city or county jail within the state of Washington between September 2011 through December 2012, you may have had your name and social security number accessed.

    Driver license numbers

  • If you received a DUI citation in Washington State between 1989 through 2011;

  • If you had a traffic case in Washington State filed or resolved in a district or municipal court between 2011 through 2012;

  • If you had a superior court criminal case in Washington State that was filed against you or resolved between 2011 through 2012, you may have had your name and driver license number accessed.
  • A website detailing further information about the breach, common questions and assistance has been setup at www.courts.wa.gov/databreach. A hotline has also been setup to answer questions from the public at 1-800-448-5584, from 8 a.m. to 8 p.m. Monday - Saturday.

The Washington state Administrative Office of the Courts was hacked sometime between last fall and February, and up to 160,000 Social Security numbers and 1 million driver’s license numbers may have been accessed during the data breach of its public website, officials said Thursday.

Court officials said they have only confirmed that 94 Social Security numbers were obtained and they don’t believe the larger number was compromised, but they wanted to alert the public to the possibility as a precaution.

The broader information “just happened to be on a server in an area that was accessed,” said Veronica Diseth, director of the courts’ information services division.

The breach happened due to vulnerability in an Adobe Systems Inc. software program, ColdFusion, that has since been patched, court officials said. The hack happened sometime after September but wasn’t caught until February, they said.

In a written statement, Adobe spokeswoman Heather Edell noted that the issue has been resolved.

“Adobe recommends that users follow security best practices by updating software to the latest version available,” she wrote.

Mike Keeling, the courts’ information technology operations and maintenance manager, said officials were alerted to the breach by a business on the East Coast that had a similar intrusion.

“They recognized our information in their breach log,” Keeling said, which led them to install the patch provided by Adobe and start an investigation.

When court officials were first alerted to the breach, they believed all of the information accessed was public record, and didn’t think confidential information was taken, but following an investigation by the Multi-State Information Sharing and Analysis Center, the broader breach was confirmed in April, said courts spokeswoman Wendy Ferrell.

Court officials said a law enforcement agency also investigated the case but they declined to say which one. They said the investigation was concluded and there was no information on who might be to blame.

Keeling said he didn’t believe the courts were a specific target.

“The hackers were probably opportunistic,” he said. “They were more than likely just fishing for data.”

Ferrell said that once the breach was confirmed, it took additional time to go through the files and increase security to the website, which is why there was a lag in notifying the public. The 94 known names breached are being contacted by letter, she said. The rest of the people who are potentially affected come from a defined group:

 • Those booked into a city or county jail within the state of Washington between September 2011 and December 2012 may have had their name and Social Security number accessed.

 • Names and driver’s license numbers may have been obtained from people who received a DUI citation in Washington state between 1989 through 2011, had a traffic case in Washington filed or resolved in a district or municipal court between 2011 and 2012, or had a superior court criminal case in Washington state that was filed against them or resolved between 2011 and 2012.

Keeling acknowledged that confidential information should have been kept in a different area, “and now they are.”

“I can say nothing more than it was an oversight on our part,” he said.

Keeling said officials have added a number of additional security measures, including isolating anything that could be sensitive into more protected areas, implementing code to prevent hackers from getting to other parts of a server, and new encryption rules.

Ferrell said no one from the Administrative Office of the Courts or any court in Washington state will be asking for personal information over the phone or via email related to the breach.

State officials have set up a website and hotline to answer public questions about the break: www.courts.wa.gov/databreach and 1-800-448-5584.

The Olympian is pleased to provide this opportunity to share information, experiences and observations about what's in the news. Some of the comments may be reprinted elsewhere in the site or in the newspaper. We encourage lively, open debate on the issues of the day, and ask that you refrain from profanity, hate speech, personal comments and remarks that are off point. Thank you for taking the time to offer your thoughts.

Commenting FAQs | Terms of Service