US Postal Service Breach Compromises Employee, Customer Data

The US Postal Service has been hit by a breach of its information systems, possibly resulting in the theft of the personal information of more than 800,000 people, including employees, directors and regulators.

The breach has also affected an unknown number of customers, but the data in their case was less sensitive, the USPS said on Monday.

Employee data compromised

The service said the intrusion was “limited in scope”, but may have compromised employee information including names, dates of birth, Social Security numbers, addresses, dates of employment and emergency contact information.

The intrusion also compromised call centre data, including the names, addresses, telephone numbers of people who contacted the Postal Service Customer Care line between January 1 and August 16 of this year. The service said it does not believe the customer data would be sufficient to permit identity theft or fraud, and said customers do not need to take any action.

“Fortunately, we have seen no evidence of malicious use of the compromised data and we are taking steps to help our employees protect against any potential misuse of their data,” said Postmaster General Patrick Donahoe in a statement.

USPS spokesman David Partenheimer said the USPS has implemented measures to improve security as a result of the incident. He said revenue systems weren’t affected, and credit and debit card numbers were not involved in the attack.

China involvement?

The USPS was first alerted to suspicious activity in mid-September, and the breach occurred sometime after that, Partenheimer said. He said the service is working with government and private-sector groups, led by the FBI, in dealing with the issue. Users and employees weren’t notified until this week in order to avoid compromising remediation eforts, he said.

Partenheimer said the attack was carried out by a “sophisticated person or group”, and the Wall Street Journal and the Washington Post both reported that there are suspicions that the attack originated in China.

The data stolen was similar to that targeted in an October attack on White House systems, which investigators traced to China, according to the Journal, which also cited an unnamed person briefed on the USPS investigation as saying that there was “evidence pointing to China”.

Even so, the Chinese government may not necessarily be involved, with the hackers possibly being independent, according to the report.

A number of high-profile security breaches have occurred in both the private and public sector this year, including a September attack on Home Depot, which confirmed last week that 53 million email addresses belonging to its customers were stolen by hackers.

Are you a security pro? Try our quiz!