American multinational technology company UKG suffered a serious cyber security incident that exposed the sensitive personal information of more than 45,000 individuals to third parties.

Headquartered in Lowell, Massachusetts, and Weston, Florida, UKG is an human resource and workforce management technology company that provides workforce management, payroll, talent, service delivery, surveys and more.

In a recent filing with the Office of the Maine Attorney General, UKG said that one of its internal files that contained employee details of one of its clients, New York City Health + Hospitals (NYCH+H), was inadvertently shared with five other clients. Immediately, an investigation was launched to understand the extent of the security incident.

UKG has clarified that the “file was not exposed beyond these five customers and UKG does not have any evidence that your information was used by any unauthorised recipient for a fraudulent purpose or that the security of your personal information is at risk.”

According to UKG, the compromised file includes sensitive personal details of NYCH+H employees such as their names, addresses, demographic information, recent salary information, Social Security Numbers, and banking and routing information.

The filing with the regulator also revealed that at least 45,966 individuals were affected by the data security incident.

“Data privacy and security are among our highest priorities, and we have extensive measures in place to protect information entrusted to us. Upon discovering the incident, we immediately took action by deleting the File from each customer’s environment within UKG’s control, and ensuring that no further copies of the File were available within UKG or customer environments managed by UKG.

“UKG worked with the five customers that inadvertently received access to the File, advised them of the incident, requested each customer delete any copies of the File in their possession, and received written assurances from each of the five customers related to the same,” the notice reads.

UKG added that to avoid any such incidents in the future, the company has changed certain workflow processes and implemented additional procedures to further strengthen the security of its IT system environments, including expanding the scanning and monitoring program of these environments.

UKG added that it has no evidence that the compromised data has been misused, however, it has urged all affected individuals to remain vigilant and review their credit reports and financial statements on a regular basis.

The company is also offering complimentary 24 months membership to Identity Defense Complete that includes credit monitoring, identity restoration, and US$1,000,000 of identity theft insurance.