Hacker hits Georgia state database via hole in security software

Computerworld - An unpatched flaw in a “widely used security program” was exploited by an unknown hacker to gain access to a Georgia Technology Authority (GTA) database containing confidential information on more than 570,000 members of the state’s pension plans.

The intrusion occurred sometime between Feb. 21 and Feb. 23 and involved a hacker who used “sophisticated hacking tools” to break through several layers of security after accessing the server hosting the database via the software flaw, said Joyce Goldberg, a GTA spokeswoman.

Goldberg refused to name the security vendor whose software was exploited, citing an ongoing investigation. She added, however, that the vulnerability exploited by the hacker had already been publicly disclosed by the vendor,

“We were in the midst of fixing the flaw that the software vendor had identified. But the hacker got in before we were able to do that,” she said. “Shortly after the breach, we saw some unusual activity, and in looking at that, we discovered the breach.”

Goldberg declined to elaborate on what that unusual activity was.

The breached server contained information on a total of eight pension plans administered by the state. The core database itself was managed by the state Employees Retirement System, though the server it was hosted on was administered by the GTA.

At this point, there is no evidence that confidential information, including names, Social Security numbers and bank-account details, have been misused, Goldberg said.

Even so, the GTA is sending out letters to 180,000 affected employees for whom it has contact information, she said. The state does not have current addresses for the remaining 373,000 individuals affected and is relying on media reports and its own outreach efforts to inform them of the potential compromise of data, Goldberg said.

The Georgia Bureau of Investigation is investigating the incident. The GTA is also bringing in outside security advisers to do a security assessment, the agency said in a note posted on its site.

This is the second major breach involving the GTA in the past year. In April 2005, the GTA disclosed that a state employee had downloaded confidential information belonging to more than 450,000 members of the state’s health benefit plan onto a home computer.

Since that breach, the GTA has implemented several measures to tighten security, including stricter password controls, more timely reviews of logs and alerts, more extensive employee background checks and stricter control of access confidential data, according to the GTA’s Web site.

Incidents such as this highlight the dangers companies face when the software they rely on to protect their data itself turns bad, said Lloyd Hession, vice president and chief technology officer at BT Radianz, a New York-based provider of telecommunications services to financial companies.