Shows & Panels
- AFCEA Answers
- Ask the CIO
- The Big Data Dilemma
- Carrying On with Continuity of Operations
- Connected Government
- Constituent Servicing
- Continuous Monitoring: Tools and Techniques for Trustworthy Government IT
- The Cyber Imperative
- Cyber Solutions for 2013 and Beyond
- Expert Voices
- Federal Executive Forum
- Federal IT Challenge
- Federal Tech Talk
- Mission-critical Apps in the Cloud
- The Path from Legacy Systems
- The Real Deal on Digital Government
- The Reality of Continuous Monitoring... Is Your Agency Secure?
- Veterans in Private Sector: Making the Transition
Shows & Panels
Cyber attack against TSP contractor exposes thousands of accounts
Friday - 5/25/2012, 2:12pm EDT
Of the compromised accounts, about 43,000 had personal information, such as names, Social Security numbers and bank-account numbers exposed. Another 80,000 compromised accounts had only Social Security numbers and other TSP-related information exposed.
However, there is no indication the data has been misused, according to the Federal Retirement Thrift Investment Board. There is also no evidence the TSP's network or its website was affected.
Serco, Inc., a Reston, Va.-based IT firm, operates the board's data centers and maintains the TSP record-keeping system. The FBI uncovered the breach and informed the TSP board in April.
"We sincerely regret that this event occurred ... We are working with Serco and other security experts to ensure that TSP data is protected and secure," said Greg Long, director of the FRTIB.
Painstaking process to identify account-holders
The board will mail letters to affected participants beginning today.
Despite being informed of the attack in April, it took five weeks for the board to identify all of the affected account-holders.
"The data we got was in numerous files and was not in a usable format," said Kim Weaver, TSP's director of external relations, in an email to Federal News Radio. "Some files were simply strings of numbers, which we had to untangle" to determine what personally identifiable information had been exposed, she added. Finally, the information was checked against the TSP database to pinpoint a match.
"We have announced the breach as quickly as we were able," Weaver said.
Once Serco was informed of the attack, the company shut down the compromised computer and both the company and the FRTIB launched a task force to review computer security procedures.
The board has also established a call center to provide credit monitoring and will flag all affected TSP accounts to make sure future account activity "receives heightened scrutiny," according to the board's release.
The TSP, federal employees' 401(k)-style retirement savings plan, has about 4.5 million accounts and total assets of about $313 billion.