Calif. Insurance Department Records Hacked

By Mark E. Ruquet

NU Online News Service, July, 12, 3:07 p.m.EDT?The California Department of Insurance said aninvestigation is continuing to discover who hacked into itscomputer server containing social security numbers and otherpre-licensing information belonging to nearly 600 agents.[@@]

Despite the breach, however, the department said that encryptedcoding should keep the hacker from reading any of the material.

Some 599 agents who were in the process of getting theirproducer licenses were affected by the hacker's break-in, thedepartment said.

The activity occurred on June 30. The department said it issending letters to affected applicants whose name, address andsocial security numbers were on the system.

Byron Tucker, communication director for Insurance CommissionerJohn Garamendi, said that it appears the incident began around 6a.m. and was not discovered for two hours when technicians noticedthe department's server was being used to transfer movie and musicfiles to a foreign source. Technicians forced the user off theserver as soon as the activity was discovered.

This was an isolated incident and it is extremely rare foranyone to access the department's system, said Mr. Tucker. Heemphasized that if the hacker copied any records the encryptionused by the department makes it virtually impossible to open thefiles without a key to access.

The processing of the pre-licensing applications was notaffected by the incident, said Mr. Tucker. A new server andupgraded security were implemented within 17 hours after theincident, he noted. However, it took slightly more than a week todetermine who was affected, he added.

The incident was reported to the California Highway Patrol,which is still investigating the incident, and the Department ofFinance, Technology Oversight Security Unit.

While the information is encrypted and "it is highly unlikelythat the information was compromised," the department advised thatanyone receiving a letter should order copies of their creditreports to make sure there is no "unauthorized activity."

Anyone concerned about their information can contact ArchieAlimagno, the insurance department's information security officer,at (916) 492-3353.