A sophisticated cyber attack against the Thrift Savings Plan contractor responsible for maintaining the agency’s data centers compromised the information of 123,000 TSP participants.
Of the compromised accounts, about 43,000 had personal information, such as names, Social Security numbers and bank-account numbers exposed. Another 80,000 compromised accounts had only Social Security numbers and other TSP-related information exposed.
The board will mail letters to affected participants beginning today.
Despite being informed of the attack in April, it took five weeks for the board to identify all of the affected account-holders.
“The data we got was in numerous files and was not in a usable format,” said Kim Weaver, TSP’s director of external relations, in an email to Federal News Radio. “Some files were simply strings of numbers, which we had to untangle” to determine what personally identifiable information had been exposed, she added. Finally, the information was checked against the TSP database to pinpoint a match.
“We have announced the breach as quickly as we were able,” Weaver said.
Once Serco was informed of the attack, the company shut down the compromised computer and both the company and the FRTIB launched a task force to review computer security procedures.
The board has also established a call center to provide credit monitoring and will flag all affected TSP accounts to make sure future account activity “receives heightened scrutiny,” according to the board’s release.
The TSP, federal employees’ 401(k)-style retirement savings plan, has about 4.5 million accounts and total assets of about $313 billion.