Benton shared that a vulnerability in the Unemployment Insurance Portal was reported to the Education and Workforce Development Cabinet on April 23.
According to Benton, there were two verifiable reports of the vulnerability. Under the vulnerability, some people may have been able to see the identity verification documents that had been uploaded by other individuals using the system. Although there are currently no reports of identity theft or financial harm as a result.
In an effort to prevent further harm, while working with the Kentucky Commonwealth Office of Technology, the portal was taken offline. A short time later, officials had modified the system to ensure no one was able to view any uploaded documents, and by midnight the security team had patched the software to correct the problem going forward.
"Nothing is more important than keeping Kentuckians safe during the COVID-19 crisis." Benton continued, "That includes keeping their information safe."
Benton says that due to the way the uploaded documents are processed, it will be impossible to determine how many important documents were viewed at the time of the incident. Officials believe the likelihood of damage is low, however anyone whose personal information may have been compromised will be receiving a letter or email.
Beshear thanked Benton and his staff for reacting to the issue quickly internally, but shared that he was unsatisfied with the response.
He said, "I do want you to know that I'm not satisfied by the response. While there is no indication that anyone has been or will be financially harmed, I do believe it took way to long to provide public notice. This was back in April."
Beshear says he has asked an Inspector General from a separate cabinet to take a look at the breach to ensure their software is where it needs to be, and to review their policies and procedures.
"I want to make sure that we respond quickly and we respond correctly each and every time," Beshear said.
As of Thursday there were 113 new cases of the virus in the Commonwealth, bringing the total number of cases to 9,184. Out of the new cases, six were in McCracken County, and one in Christian and Fulton Counties. There are currently 494 Kentuckians hospitalized with the virus, with 88 of those in the ICU. Nine more Kentuckians have passed away after contracting the virus, while 3,181 have recovered.
