KNOXVILLE, Tenn. — The Tennessee Consolidated Retirement System said they sent notices to retirees about a security breach that was confirmed on June 26.
They said personal information was included in the security breach like names, social security numbers, dates of birth and mailing addresses. No banking information or payment information was accessed, according to a release from TCRS.
They said a vendor that uses MOVEit Transfer was affected by a larger-scale security breach. That vendor, Pension Benefits Information, audits address and death records and is used by other companies across the U.S. The vendor uses the MOVEit program, which is meant to securely transfer files between users.
However, the company behind MOVEit found a flaw in their code which allowed unauthorized users to exploit it. That flaw resulted in companies and agencies across the U.S. experiencing a security breach. On June 26, TCRS said the security breach had affected 171,836 retirees and their beneficiaries.
They released a statement about the security breach, available below.
TCRS issued a release on June 28 of our efforts to alert our retired members and their beneficiaries that their personal information was included in the data security breach experienced by MOVEit Transfer. MOVEit is a managed file transfer software, that encrypts files and uses secure File Transfer Protocols to transfer data. MOVEit was utilized by Pension Benefit Information (PBI), a third-party vendor utilized by TCRS to verify retiree information to prevent overpayments to retirees. TCRS systems were not impacted in any way.
The TCRS started sending notifications to impacted people on June 28. Impacted people have access to credit monitoring services and identity restoration services through Kroll for free. People impacted should receive a letter from PBI by July 15 on how to use the services.