Several computers containing human resources records belonging to former and current employees of Homebridge Inc. (formerly known as In-Home Supportive Services Consortium) were compromised in a cyberattack.
The California-based home care company believes cybercriminals may have had access to the sensitive information for a month and a half.
According to the investigation that followed the discovery of the incident on March 13, the attackers managed to penetrate the systems on January 24. Therefore, the data was exposed between that time period.
Homebridge says the information that could have been leaked includes employees' first and last names, addresses and social security numbers.
This information is sufficient for fraudsters to file false tax returns with the IRS using the name of the legal owner.
In fact, the company says it has received reports that stolen information was used in this way. The tax filing deadline is April 15, and anyone who delays is likely to be sending their tax refunds into the pockets of cybercriminals.
After discovering the breach, Homebridge contracted with a forensics and data security to assist in the investigation.
In addition to removing the malware from its systems, Homebridge has also taken steps to increase the security of its network. However, the notification letter to affected individuals does not disclose the new measures that have been put in place.
Additionally, Homebridge is offering a free one-year subscription to an identity protection and credit monitoring service to reduce the chances of its employees falling victim to identity theft.
