A hacker contacted the Los Angeles Information Technology
Agency last week and claimed to have stolen personal information of 2,500
members of the LAPD and 17,500 applicants to the police force.
“Out of an abundance of caution we’re applying extra layers
of security around our personnel system and enhancing defenses,” L.A. General
Manager Ted Ross told
NBCLA.
The agency received a message from the self-proclaimed hacker
who offered to provide evidence that the names, partial Social Security numbers,
birthdates, email addresses and passwords.
Los Angeles Police Protective League, according to the news
outlet, asked the city “to provide the necessary resources and assistance to
any impacted officer who may become the victim of identity theft as a result of
this negligence, so that they may restore their credit and/or financial
standing.”
The department began alerting potential victims over the weekend.
“There isn’t much
difference in this incident than what has been happening across other state and
city governments in Florida, Baltimore and Atlanta. Even Louisiana declared a
Cybersecurity State of Emergency last week,” said Terence Jackson, CISO at
Thycotic, who explained “attackers are attacking these targets because of the
criticality of the data they store and now the precedent has been set that
insurance companies will foot the bill for the ransom.”
LAPD may not have labeled
the breach as a ransomware attack, Morales said, “data has been exfiltrated and
will likely appear on the dark web for sale soon.”
Names and email addresses
aren’t difficult to come by, he said. “The last bit, the password, is the one
that matters the most here. Those should obviously be changed immediately for
the impacted site,” he said. “Every person compromised should also verify if
they have reused that password in other locations, which is the highest value
of obtaining a password.”
Gloss