Another glitch hits state’s unemployment computer system

LEXINGTON, Ky. (WTVQ) – The state is dealing with another data breach in its unemployment insurance computer system.

And although this time the breach, which occurred Monday, was reported sooner and didn’t involve a person’s name or Social Security number, it did spark quick political criticism.

But Gov. Andy Beshear stressed Wednesday afternoon the possibility of harm to someone’s credit or finances is remote.

“It was one or possibly two people impacted at most,” Beshear said when asked about it during his daily coronavirus briefing. “We’re not sure it was even a breach.

“No one has been financially harmed or had their credit damaged,” he said, referring to both the current incident and another one that occurred in April.

The issue, he said, lies in part, in a 20-year-old computer system. The state is in the process of taking bids on a replacement.

“Let’s make sure we invest in infrastructure, whether it’s IT or otherwise,” he said.

In a statement to WTVQ-TV ABC 36 News, the state Labor Cabinet said: “On July 27, 2020, at approximately 4 p.m., the Office of Unemployment Insurance was notified that a claimant had seen information pertaining to another individual claimant while navigating his own unemployment application in the OUI online system. The information seen by the claimant was another individual’s employer information and information about the individual’s health. At no time, was the other individual’s name, social security number, or other personally identifying information available. Out of an abundance of caution, OUI has reported this potential breach while the Office of Technology Services investigates the circumstances that allowed a claimant to see the information pertaining to another individual claimant. Once the Office of Technology determines the cause of the potential breach, actions will be taken to prevent this type of incident in the future.”

As it has repeatedly during the last two months, the state’s Republican Party took advantage, saying in a statement from spokesperson Mike Lonergan: “Andy Beshear’s unemployment insurance debacle continues to put Kentuckians suffering under his orders and failed leadership at risk every day. From struggling to deliver the benefits Kentuckians need to make ends meet during this crisis to compromising the information of applicants, Andy Beshear’s unemployment office is one abysmal failure after another. Andy Beshear needs to take responsibility for this disaster that his administration has caused.”

It’s not the first time it’s happened.

A similar breach, with potentially more people disclosed, happened on April 23 but was not revealed by the state until May 28, when Beshear announced it during one of his daily briefings. At the time, an obviously upset Beshear said he’d only learned of the problem a few days earlier and that management in the unemployment office didn’t think the problem was serious or met state standards for disclosure

Since then, the state has stressed it knows of no people receiving unemployment benefits or who had filed who had their identity or information stolen. A computer team corrected the problem then and letters were sent to people in the system about the potential issues, although state officials stressed the chances of criminal activity was slight.

Credit reporting agencies also were alerted, the governor said in the days following his initial disclosure.

The incident was caused by an internal technical problem, not an external intrusion, according to documents prepared by the Education and Workforce Development Cabinet and obtained by Louisville The Courier Journal.

According to a July 9 report, the cabinet knew of two verified reports of claimants who were able to view others’ identification verification documents that they had uploaded, the newspaper reported.

“In addition, the unique set of technical parameters that led to this incident were very specific and not easily replicated,” reads the report obtained by the Courier-Journal. “These factors indicate the number of individuals whose information was actually viewed by other claimants is extremely low.”

At the time, Beshear asked for the Inspector General in the Transportation Cabinet to review the handling of the situation.

That report is expected “soon,” Beshear said Wednesday.

That report, the governor said, will likely show the “response was everything we would want it to be on the technical side.”

However, on the reporting side, the staff “could have done a better job” by either “receiving mistaken advice or failing to recognize it was mistaken advice,” the governor stated.