LAPD Loses Data On Thousands Of Cops In Breach

The personal information of 2,500 Los Angeles police department officers and 17,500 people who had applied to join the force were exposed in a data breach, the department announced on Monday.

The department was informed of a potential breach of records held by the city’s personnel department on 25 July, and it notified affected officers over the weekend.

“The Los Angeles Police Department is working with our city partners to better understand the extent and impact of the data breach,” LAPD said in a statement. “We are also taking steps to ensure the department’s data is protected from any further intrusions.”

The compromised data included officers’ names, dates of birth, the last four digits of their social security numbers, and the email addresses and passwords they set up when applying for the job, a spokesman for the mayor’s office confirmed to the Guardian.

“We take the protection of personal data very seriously, and the City has informed the individuals who may have been affected,” the spokesman for Mayor Eric Garcetti said. “The City’s Information Technology Agency has added additional layers of security to guard against future events of this kind.”

The mayor’s office said police officers were notified “out of an abundance of caution” after a potential hacker contacted the city claiming to have the data. The city is investigating whether the data in question has been sold or exposed.

The spokesman noted that the city of Los Angeles had launched a number of cybersecurity programs since Garcetti took office. Cities and law enforcement agencies have been increasingly targeted by hackers in recent years.

Some cities have been targeted for political reasons. In 2015, Anonymous shut down the website of the city of Baltimore after riots following the death of Freddie Gray. Anonymous also shut down the official website for the city of Cleveland following the police shooting of 12-year-old Tamir Rice in 2014.

But city and state governments, as well as local police forces, have also increasingly been the victims of ransomware attacks, said Terence Jackson, chief information security officer at Thycotic, a Washington DC security provider.

“The attackers are attacking these targets because of the criticality of the data they store,” he said. “This should be a wake-up call to municipalities all over the country to re-assess their current state of cyber security, find the gaps and implement the necessary countermeasures.”

Many city agencies lack funding to properly secure data and investigate after the hacks, said Arshad Noor, chief technology officer of StrongKey, aSilicon Valley data security company.

“While the breach is just another example of what happens when security controls are mismatched to the resources being protected, there is a different kind of danger when the theft of personal data involves law enforcement officials,” he said. “In the case of law enforcement officers, the data may have unique value when those law enforcement officers are involved in sensitive cases, where, depending on the information stolen, it might be used to affect the outcome of such cases.”

LAPD said it would be in contact with affected members of the police force about whether there were continuing privacy concerns surrounding the hack.

READ MORE HERE