KY attorney general, auditor question Beshear about security breach in unemployment system
Two state Republican officials called on Democratic Gov. Andy Beshear ‘s administration Friday to explain a delay in disclosing an April 23 breach in the state’s unemployment system that could have compromised sensitive information of filers during the coronavirus pandemic.
Attorney General Daniel Cameron and Auditor Mike Harmon said they want Beshear and the Education and Workforce Development Cabinet to explain why the administration waited more than a month to disclose the breach.
They also said the administration failed to report the breach to their offices within three days as required by law until being pressed to do so.
The Republican officials noted that state legislators in 2014 passed a law to require government agencies that suffer a security breach to report it to the auditor, attorney general and Kentucky State Police within three days.
They said the law also requires the agency to investigate the matter and inform those whose information was compromised.
“Kentuckians have suffered incredible financial hardship as a result of COVID-19, resulting in nearly 40 percent of our workforce applying for unemployment benefits and entrusting their information to our Education and Workforce Development Cabinet,” said Cameron.
“The Beshear administration’s lack of transparency and failure to promptly notify Kentuckians and our office of the breach suggest carelessness and a disregard for the importance of protecting the personal and financial information of our citizens.”
“Given how damaging identity theft can be to any of us, especially those out of work due to the pandemic, notifying those impacted by the UI breach and informing our office was imperative,” said Harmon.
“It is troubling the notifications, which are supposed to happen within two to three days, took more than a month.”
Cameron said his consumer protection office on May 19 sent a letter to Lt. Governor Jacqueline Coleman, who also serves as secretary of the Education and Workforce Development Cabinet, about the potential breach.
In the letter, Cameron said, Consumer Protection Director Chris Lewis asked Coleman to confirm that such a breach had occurred and begin a reasonable and prompt investigation.
On May 22, Cameron said, Education and Workforce Development Cabinet general counsel Joanna Decker responded to Lewis’ letter and confirmed that a security breach had occurred.
He said Decker provided Lewis with the notification form required by state law but the form “was incomplete and conflicted with the letter by stating that such a breach had not occurred.”
The education cabinet also separately notified Harmon’s office, with a letter and reporting form containing the same discrepancy, Cameron said.
After separately inquiring about the discrepancy, the attorney General’s office and the auditor received a completed notification form, notifying the office of the breach Thursday evening, only after Beshear announced the breach in his daily press conference.
Beshear said Friday and Thursday at his COVID-19 update news conferences that he hopes the attorney general and auditor “got information from us” before they came to a conclusion and put out their news release.
Beshear said he was disappointed that it took so long to disclose publicly the breach and that he had not learned about it until last week from an email between the cabinet and Cameron’s office.
He said the cabinet initially did not think it was a breach but that he disagreed. The cabinet said the situation was detected and fixed in a matter of hours.
“Ultimately I made the call that we were going to err of making sure that we provided direct and full notice,” he said.
Beshear has moved the state’s unemployment office into the Labor Cabinet and has asked the inspector general in the Transportation Cabinet to investigate. He also said he was told that the breach did not cause delays in handling unemployment claims.
Harmon said his office will audit the unemployment insurance program.
Cameron and Harmon urged Kentuckians who applied for unemployment insurance between March 1 and April 30 to monitor their credit and be vigilant against scams.
Federal law permits Kentuckians to receive a free copy of their credit report every twelve months from the three major credit reporting agencies. To use this free program, visit annualcreditreport.com.
Any person who has knowledge of a scam is asked to notify the attorney general’s office by calling 888-432-9257 or completing a form at ag.ky.gov/scams.
This story was originally published May 29, 2020 at 5:35 PM.
