The accounts of more than 450,000 people who have certain employee benefit retirement plans and receive monthly payments processed by J.P. Morgan were compromised earlier this year, NJ Advance Media has learned.
The company said it was not a cyberattack, but rather, a software issue that wrongly allowed three “authorized system users” to access information about the accounts.
The breach was discovered on Feb. 26, 2024 and it revealed names, addresses, Social Security numbers, payment and deduction amounts, as well as bank routing and account numbers for those who receive payments by direct deposit, the company said in a letter to the affected customers.
“Three authorized systems users who are employed by our customers or their agents accessed participant data they were not entitled to see due to a software system issue,” a spokeswoman said.
Those users ran “a limited number of reports” including the customer information between Aug. 26, 2021 and Feb. 23, 2024, the company said, totaling about 451,000 customers.
“We promptly addressed the access issue and have applied a software update,” the letter told customers.
The company said that while it has no indication any of the information was “misused,” it is offering two years of free credit monitoring through Experian.
RELATED:
Roku data breach grows: Nearly 600K users compromised, company says.
Massive cyberattack crippled a healthcare payment system a month ago. It’s not fixed yet.
I went to a ShopRite self-checkout counter. I was on high alert when I left my credit card behind.
Stories by Karin Price Mueller
Please subscribe now and support the local journalism YOU rely on and trust.
Karin Price Mueller may be reached at [email protected]. Follow her on X at @KPMueller.