Ohio Lottery said it experienced a data security incident that compromised the sensitive personal information of more than 535,000 individuals.
In a filing with the Office of the Maine Attorney General, Ohio Lottery said that on Christmas Eve, it detected unauthorised access to portions of its internal network. Immediately, the company launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.
“After an extensive forensic investigation and our manual document review, we learned on April 5, 2024 that certain files containing your personal information was subject to unauthorised access,” reads the notice.
The compromised data included names and other personal identifiers along with Social Security Numbers. The filing with the Maine state regulator also revealed that at least 538,959 individuals were impacted by the incident.
“Upon learning of this issue, we immediately took steps to secure the threat and commenced a prompt and thorough investigation. The incident did not impact the gaming network,” Ohio Lottery added.
The company added that it found no evidence of the compromised information being misused, but has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.
It has also offered one year of complimentary identity protection and credit monitoring services through IDX to all affected individuals.
On December 27, the DragonForce ransomware group claimed responsibility for the cyber attack on Ohio Lottery and listed it on its data leak site.
After a failed ransom negotiation, on January 22, the hacker group published 94.74 GB of data stolen from the company that included names, Social Security numbers, and dates of birth of Ohio Lottery customers.
