ADP Data Breach: What & How It Happened?
Twingate Team
•
Jun 20, 2024
In May 2016, ADP, a payroll processing company, experienced a data breach that exposed the tax information of some employees of its clients, making them vulnerable to tax fraud and identity theft. Cybercriminals exploited unique ADP corporate registration codes posted on unsecured websites to create fake ADP accounts and access the tax information. The breach was discovered after several customers reported fraudulent transactions made through ADP's self-service portal, with at least one institution, U.S. Bancorp (U.S. Bank), being directly impacted.
How many accounts were compromised?
The breach impacted approximately 1,280 users from U.S. Bancorp, with the total number of affected individuals not explicitly mentioned.
What data was leaked?
The data exposed in the breach included tax information of employees of some ADP clients.
How was ADP hacked?
Cybercriminals exploited unsecured company registration codes posted on public websites by some ADP clients, using these codes along with personal identifiable information obtained from other sources to create fake ADP accounts and access employee tax information. The breach was discovered after several customers reported fraudulent transactions made through ADP's self-service portal.
ADP's solution
In response to the data breach, ADP took several measures to secure its platform and prevent future incidents. This included monitoring the web for any other clients who may have shared their signup links and unique company codes, and turning off self-service registration access if such codes were found. ADP's Chief Security Officer, Roland Cloutier, assured the rest of its massive customer base that they had "aggressively put in some security intelligence" to address the issue. Additionally, ADP investigated the unauthorized access after receiving reports of fraudulent transactions made through its self-service portal and worked with a federal law enforcement task force to identify the perpetrators. However, specific details about ADP's enhanced security measures remain unclear.
How do I know if I was affected?
ADP has not explicitly mentioned reaching out to affected users. If you are an employee of an ADP client and are concerned about the breach, you may visit Have I Been Pwned to check if your credentials have been compromised.
What should affected users do?
In general, affected users should:
Change Your Password: Immediately update your password for the affected account. Make sure the new password is strong and unique, not previously used on any other platform.
Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.
Enable Two-Factor Authentication (2FA): Activate 2FA on the affected account. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.
Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity and report any unauthorized transactions to the appropriate parties.
For more specific help and instructions related to ADP's data breach, please contact ADP Customer Service directly.
Where can I go to learn more?
If you want to find more information on the ADP data breach, check out the following news articles:
Rapidly implement a modern Zero Trust network that is more secure and maintainable than VPNs.
ADP Data Breach: What & How It Happened?
Twingate Team
•
Jun 20, 2024
In May 2016, ADP, a payroll processing company, experienced a data breach that exposed the tax information of some employees of its clients, making them vulnerable to tax fraud and identity theft. Cybercriminals exploited unique ADP corporate registration codes posted on unsecured websites to create fake ADP accounts and access the tax information. The breach was discovered after several customers reported fraudulent transactions made through ADP's self-service portal, with at least one institution, U.S. Bancorp (U.S. Bank), being directly impacted.
How many accounts were compromised?
The breach impacted approximately 1,280 users from U.S. Bancorp, with the total number of affected individuals not explicitly mentioned.
What data was leaked?
The data exposed in the breach included tax information of employees of some ADP clients.
How was ADP hacked?
Cybercriminals exploited unsecured company registration codes posted on public websites by some ADP clients, using these codes along with personal identifiable information obtained from other sources to create fake ADP accounts and access employee tax information. The breach was discovered after several customers reported fraudulent transactions made through ADP's self-service portal.
ADP's solution
In response to the data breach, ADP took several measures to secure its platform and prevent future incidents. This included monitoring the web for any other clients who may have shared their signup links and unique company codes, and turning off self-service registration access if such codes were found. ADP's Chief Security Officer, Roland Cloutier, assured the rest of its massive customer base that they had "aggressively put in some security intelligence" to address the issue. Additionally, ADP investigated the unauthorized access after receiving reports of fraudulent transactions made through its self-service portal and worked with a federal law enforcement task force to identify the perpetrators. However, specific details about ADP's enhanced security measures remain unclear.
How do I know if I was affected?
ADP has not explicitly mentioned reaching out to affected users. If you are an employee of an ADP client and are concerned about the breach, you may visit Have I Been Pwned to check if your credentials have been compromised.
What should affected users do?
In general, affected users should:
Change Your Password: Immediately update your password for the affected account. Make sure the new password is strong and unique, not previously used on any other platform.
Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.
Enable Two-Factor Authentication (2FA): Activate 2FA on the affected account. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.
Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity and report any unauthorized transactions to the appropriate parties.
For more specific help and instructions related to ADP's data breach, please contact ADP Customer Service directly.
Where can I go to learn more?
If you want to find more information on the ADP data breach, check out the following news articles:
Rapidly implement a modern Zero Trust network that is more secure and maintainable than VPNs.
ADP Data Breach: What & How It Happened?
Twingate Team
•
Jun 20, 2024
In May 2016, ADP, a payroll processing company, experienced a data breach that exposed the tax information of some employees of its clients, making them vulnerable to tax fraud and identity theft. Cybercriminals exploited unique ADP corporate registration codes posted on unsecured websites to create fake ADP accounts and access the tax information. The breach was discovered after several customers reported fraudulent transactions made through ADP's self-service portal, with at least one institution, U.S. Bancorp (U.S. Bank), being directly impacted.
How many accounts were compromised?
The breach impacted approximately 1,280 users from U.S. Bancorp, with the total number of affected individuals not explicitly mentioned.
What data was leaked?
The data exposed in the breach included tax information of employees of some ADP clients.
How was ADP hacked?
Cybercriminals exploited unsecured company registration codes posted on public websites by some ADP clients, using these codes along with personal identifiable information obtained from other sources to create fake ADP accounts and access employee tax information. The breach was discovered after several customers reported fraudulent transactions made through ADP's self-service portal.
ADP's solution
In response to the data breach, ADP took several measures to secure its platform and prevent future incidents. This included monitoring the web for any other clients who may have shared their signup links and unique company codes, and turning off self-service registration access if such codes were found. ADP's Chief Security Officer, Roland Cloutier, assured the rest of its massive customer base that they had "aggressively put in some security intelligence" to address the issue. Additionally, ADP investigated the unauthorized access after receiving reports of fraudulent transactions made through its self-service portal and worked with a federal law enforcement task force to identify the perpetrators. However, specific details about ADP's enhanced security measures remain unclear.
How do I know if I was affected?
ADP has not explicitly mentioned reaching out to affected users. If you are an employee of an ADP client and are concerned about the breach, you may visit Have I Been Pwned to check if your credentials have been compromised.
What should affected users do?
In general, affected users should:
Change Your Password: Immediately update your password for the affected account. Make sure the new password is strong and unique, not previously used on any other platform.
Reset Passwords for Other Accounts: If you've used the same or similar passwords for other online accounts, reset those as well. This is crucial as attackers often try using stolen passwords on multiple sites.
Enable Two-Factor Authentication (2FA): Activate 2FA on the affected account. Consider enabling this additional security feature on all other important online accounts to significantly reduce the risk of unauthorized access.
Monitor Your Accounts: Keep an eye on your accounts for any suspicious activity and report any unauthorized transactions to the appropriate parties.
For more specific help and instructions related to ADP's data breach, please contact ADP Customer Service directly.
Where can I go to learn more?
If you want to find more information on the ADP data breach, check out the following news articles:
Solutions
Solutions
The VPN replacement your workforce will love.
Solutions