After hackers this month attacked a popular online tool to transfer digital files, the Minnesota Department of Commerce advises Minnesota consumers to take steps to prevent harm if their personal information is compromised in a data breach. 

The most recent cyberattack, attributed to the Russian hacker group Clop, exploited a security vulnerability in a file-transfer tool called MOVEit. One cybersecurity firm estimates that 3,000 organizations use MOVEit. Other targets in May and early June were the BBC, British Airways and the Nova Scotia government. The company that owns MOVEit, Progress, has released two security patches since June 1. 

The Department of Commerce regulates nearly 50 industries in Minnesota. A 2021 state law requires insurance companies to report security breaches to Commerce. They must also notify customers if their investigation confirms that hackers gained access to personal data like credit card information or Social Security numbers. 

“State laws are evolving to keep up with the technology and sophistication of cyber criminals,” said Jacqueline Olson, Assistant Commissioner for Enforcement. “We also know Minnesota companies that rely on personal information take seriously the responsibility of protecting that data. Commerce holds them to very high standards.” 

If you receive a notice from your insurance company about unauthorized access to personal data, review the letter so you understand your rights as a customer. 

For more information about how to handle a situation where your information is compromised, the Minnesota Attorney General’s office recommends that consumers call one of the three major credit bureaus if they believe their personal information was part of a data breach. The office offers more helpful tips in an online publication called What to Do When Your Personal Information is Breached. 

MEDIA CONTACTS: 

Brett Benson, Assistant Director of Communications
Minnesota Department of Commerce
brett.benson@state.mn.us