State’s Office of the Courts public website hacked

OLYMPIA, Wash. — The Washington state Administrative Office of the Courts was hacked sometime between last fall and February, and up to 160,000 Social Security numbers and 1 million driver’s license numbers may have been accessed during the data breach of its public website, officials said Thursday.

Court officials said they have only confirmed that 94 Social Security numbers were obtained and they don’t believe the larger number was compromised, but they wanted to alert the public to the possibility as a precaution.

The broader information “just happened to be on a server in an area that was accessed,” said Veronica Diseth, director of the courts’ information services division.

The breach happened due to vulnerability in an Adobe Systems Inc. software program, ColdFusion, that has since been patched, court officials said. The hack happened sometime after September but wasn’t caught until February, they said.

Telephone and email messages were left for Adobe representatives seeking comment.

Mike Keeling, the courts’ information technology operations and maintenance manager, said officials were alerted to the breach by a business on the East Coast that had a similar intrusion.

“They recognized our information in their breach log,” Keeling said, which led them to install the patch provided by Adobe and start an investigation.

When court officials were first alerted to the breach, they believed all of the information accessed was public record, and didn’t think confidential information was taken, but following an investigation by the Multi-State Information Sharing and Analysis Center, the broader breach was confirmed in April, said courts spokeswoman Wendy Ferrell.

Court officials said a law enforcement agency also investigated the case but they declined to say which one. They said the investigation was concluded and there was no information on who might be to blame.

Keeling said he didn’t believe the courts were a specific target.

“The hackers were probably opportunistic,” he said. “They were more than likely just fishing for data.”

Ferrell said that once the breach was confirmed, it took additional time to go through the files and increase security to the website, which is why there was a lag in notifying the public. The 94 known names breached are being contacted by letter, she said. The rest of the people who are potentially affected come from a defined group:

•Those booked into a city or county jail within the state of Washington between September 2011 and December 2012 may have had their name and Social Security number accessed.

Names and driver’s license numbers may have been obtained from people who received a DUI citation in Washington state between 1989 through 2011, had a traffic case in Washington filed or resolved in a district or municipal court between 2011 and 2012, or had a superior court criminal case in Washington state that was filed against them or resolved between 2011 and 2012.

Keeling acknowledged that confidential information should have been kept in a different area, “and now they are.”

“I can say nothing more than it was an oversight on our part,” he said.

Keeling said officials have added a number of additional security measures, including isolating anything that could be sensitive into more protected areas, implementing code to prevent hackers from getting to other parts of a server, and new encryption rules.

Ferrell said no one from the Administrative Office of the Courts or any court in Washington state will be asking for personal information over the phone or via email related to the breach.

State officials have set up a website and hotline to answer public questions about the break: http://www.courts.wa.gov/databreach and 1-800-448-5584.

Michael Cockrill, the state’s chief information officer, said security experts have determined there were no breaches at state agencies, which are on a separate network.

“Cybersecurity and cyberterrorism attacks continue to rise in number and sophistication every year, affecting the private and public sector, and countless individuals,” Cockrill said in a written statement. “The AOC data breach is a sobering reminder for every branch and every level of government that protection of personal and confidential data entrusted to government is a paramount responsibility.”

Cockrill said Gov. Jay Inslee has directed his office and Consolidated Technology Services in the executive branch to assist the Office of the Courts to enhance the security of its judicial data.

Washington state Court Administrator Callie Dietz said that if any of the 94 people who are contacted by the court request credit monitoring, “we certainly will provide whatever we can do for them.”

Talk to us

> Give us your news tips.

> Send us a letter to the editor.

> More Herald contact information.

More in Local News

A firefighter stands in silence before a panel bearing the names of L. John Regelbrugge and Kris Regelbrugge during the ten-year remembrance of the Oso landslide on Friday, March 22, 2024, at the Oso Landslide Memorial in Oso, Washington. (Ryan Berry / The Herald)
‘Flood of emotions’ as Oso Landslide Memorial opens on 10th anniversary

Friends, family and first responders held a moment of silence at 10:37 a.m. at the new 2-acre memorial off Highway 530.

Julie Petersen poses for a photo with images of her sister Christina Jefferds and Jefferds’ grand daughter Sanoah Violet Huestis next to a memorial for Sanoah at her home on March 20, 2024 in Arlington, Washington. Peterson wears her sister’s favorite color and one of her bangles. (Annie Barker / The Herald)
‘It just all came down’: An oral history of the Oso mudslide

Ten years later, The Daily Herald spoke with dozens of people — first responders, family, survivors — touched by the deadliest slide in U.S. history.

Victims of the Oso mudslide on March 22, 2014. (Courtesy photos)
Remembering the 43 lives lost in the Oso mudslide

The slide wiped out a neighborhood along Highway 530 in 2014. “Even though you feel like you’re alone in your grief, you’re really not.”

Director Lucia Schmit, right, and Deputy Director Dara Salmon inside the Snohomish County Department of Emergency Management on Friday, March 8, 2024, in Everett, Washington. (Ryan Berry / The Herald)
How Oso slide changed local emergency response ‘on virtually every level’

“In a decade, we have just really, really advanced,” through hard-earned lessons applied to the pandemic, floods and opioids.

Ron and Gail Thompson at their home on Monday, March 4, 2024 in Oso, Washington. (Olivia Vanni / The Herald)
In shadow of scarred Oso hillside, mudslide’s wounds still feel fresh

Locals reflected on living with grief and finding meaning in the wake of a catastrophe “nothing like you can ever imagine” in 2014.

The rezoned property, seen here from the Hillside Vista luxury development, is surrounded on two sides by modern neighborhoods Monday, March 25, 2024, in Lake Stevens, Washington. (Ryan Berry / The Herald)
Despite petition, Lake Stevens OKs rezone for new 96-home development

The change faced resistance from some residents, who worried about the effects of more density in the neighborhood.

Rep. Suzan DelBene, left, introduces Xichitl Torres Small, center, Undersecretary for Rural Development with the U.S. Department of Agriculture during a talk at Thomas Family Farms on Monday, April 3, 2023, in Snohomish, Washington. (Olivia Vanni / The Herald)
Under new federal program, Washingtonians can file taxes for free

At a press conference Wednesday, U.S. Rep. Suzan DelBene called the Direct File program safe, easy and secure.

Former Snohomish County sheriff’s deputy Jeremie Zeller appears in court for sentencing on multiple counts of misdemeanor theft Wednesday, March 27, 2024, at Snohomish County Superior Court in Everett, Washington. (Ryan Berry / The Herald)
Ex-sheriff’s deputy sentenced to 1 week of jail time for hardware theft

Jeremie Zeller, 47, stole merchandise from Home Depot in south Everett, where he worked overtime as a security guard.

Everett
11 months later, Lake Stevens man charged in fatal Casino Road shooting

Malik Fulson is accused of shooting Joseph Haderlie to death in the parking lot at the Crystal Springs Apartments last April.

T.J. Peters testifies during the murder trial of Alan Dean at the Snohomish County Courthouse on Tuesday, March 26, 2024 in Everett, Washington. (Olivia Vanni / The Herald)
Bothell cold case trial now in jury’s hands

In court this week, the ex-boyfriend of Melissa Lee denied any role in her death. The defendant, Alan Dean, didn’t testify.

A speed camera facing west along 220th Street Southwest on Tuesday, Nov. 21, 2023 in Edmonds, Washington. (Olivia Vanni / The Herald)
New Washington law will allow traffic cams on more city, county roads

The move, led by a Snohomish County Democrat, comes as roadway deaths in the state have hit historic highs.

Mrs. Hildenbrand runs through a spelling exercise with her first grade class on the classroom’s Boxlight interactive display board funded by a pervious tech levy on Tuesday, March 19, 2024 in Marysville, Washington. (Olivia Vanni / The Herald)
Lakewood School District’s new levy pitch: This time, it won’t raise taxes

After two levies failed, the district went back to the drawing board, with one levy that would increase taxes and another that would not.

Support local journalism

If you value local news, make a gift now to support the trusted journalism you get in The Daily Herald. Donations processed in this system are not tax deductible.