Pennsylvania Office of the Attorney General (OAG) confirms data breach after August attack

The Pennsylvania Office of the Attorney General (OAG) confirms a data breach following a ransomware attack attributed to the Inc Ransom group. The organisation did not share details about the number of affected individuals, but a media notice published by OAG says that certain personal information was contained in some files and that data involved for some individuals may have included name, Social Security number, and/or medical information.

The attack occurred in August and disrupted the OAG’s website, email and phone systems for about three weeks. The Inc Ransom group claimed responsibility on 21 September and asserted the theft of 5.7 TB of sensitive data, including access to the internal network of the FBI. The OAG has set up a toll‑free call centre (1‑833‑353‑8060) to assist those affected, available Monday to Friday from 8am to 8pm ET.

According to media notice published by OAG, cybersecurity researcher Kevin Beaumont noted that the attackers may have gained entry via CitrixBleed 2 after the incident.