HELENA — Hackers have had access to a Montana Department of Public Health and Human Services’ computer server for nearly a year, and agency officials don’t know whether the personal information of clients and employees stored there was stolen, a spokesman said Thursday.
The server contains names, addresses, dates of birth, Social Security numbers and clinical information of people the agency serves, along with the Social Security numbers and bank account information of its employees.
DPHHS spokesman Jon Ebelt said he did not know how many people’s names and personal information are in the server, or whether any of that information was stolen.
“We don’t know. We’re assuming the worst, but we have no evidence from our forensic review,” Ebelt said. “We don’t believe that it was, but we can’t prove that it wasn’t.”
Employees with the agency’s information technology department noticed suspicious activity on the server on May 15. The server was shut down and agency officials contacted police.
A forensic review completed a week later found the server had been hacked, with access initially beginning in July 2013.
“That’s when we have evidence it first began. You could say it was continuous access (since then),” Ebelt said.
It is not clear who hacked into the system, he said.
“We might never know,” Ebelt said.
Health department officials are mailing letters that tell clients and agency employees whose information could have been on the server how to monitor their credit and sign up for insurance. They also set up a help line for questions at 1-800-809-2956.
Backup files from the server have been scanned onto a new server and is being brought back online, the health department said in a statement. Additional security software has been purchased and the agency is reviewing its policies and procedures to prevent another attack.
The department runs the state’s Medicaid programs, along with child and family services, public health and safety, senior care and other programs.