BronxWorks disclosed 2023 email breach exposing client and employee data

BronxWorks, a New York City nonprofit that provides housing, health, legal and family services, disclosed that an unauthorized third party had gained access to a number of employee email accounts. The organization said it secured the accounts once the activity was found and engaged a forensic security firm to examine its email systems.

The investigation determined that the intruder reached certain email accounts and a limited number of documents stored on the SharePoint and OneDrive platforms at various times between September 1 and October 11, 2023. BronxWorks said it then searched the accounts for personal information and learned on May 28, 2024 that some was present.

According to the organization's notice, the exposed data varied by individual and could have included names, Social Security numbers, driver's license and state identification card numbers, dates of birth, tax identification numbers, passport numbers, financial account numbers, online credentials, digital signatures, health insurance information and medical information.

BronxWorks filed a breach notice with the Massachusetts Attorney General on October 24, 2024 and mailed letters to potentially affected people for whom it held a valid address. It arranged complimentary identity theft protection for those whose Social Security or driver's license numbers were involved, and said it had no reason to believe the information had been misused. A total number of affected individuals was not disclosed.