HR Services Firm ComplyRight Suffers Data Breach
20.7.18 securityweek Incindent

Florida-based HR services provider ComplyRight revealed recently that its tax reporting platform was involved in a cybersecurity incident that resulted in the exposure of personal information.

ComplyRight learned on May 22 that someone had gained unauthorized access to its web-based tax reporting platform, which is used by various websites to prepare W-2, 1099 and other tax-related forms.

ComplyRight, which is owned by marketing company Taylor Corporation, provides tax solutions through efile4Biz. The efile4Biz website claims its services are used by 76,000 organizations.ComplyRight hacked

However, ComplyRight says the data breach has only impacted less than 10 percent of the individuals whose tax forms have been prepared on its platform.

An investigation conducted by the company showed that the attacker gained access to the names, addresses, phone numbers, email addresses, and Social Security numbers of individual tax form recipients. However, ComplyRight has not been able to determine whether the compromised information was actually downloaded by the unauthorized party, and says it has not seen any evidence of fraud as a direct result of the incident.

Affected individuals are being notified by mail and offered 12 months of free credit monitoring and identity theft protection services.

Security blogger Brian Krebs reported that some of the recipients of these letters were unaware of ComplyRight. The company clarified that its platform is used by various tax form preparation websites whose customers are impacted by the breach and many may not be familiar with the ComplyRight brand.

According to Krebs, the attackers had access to ComplyRight systems between April 20, 18 and May 22, 18.

“Upon learning of the issue, we disabled the platform, remediated the issue on the website, and commenced a prompt and thorough investigation using external cybersecurity professionals to determine who was potentially affected and what information was accessed or viewed,” ComplyRight stated. “Although the investigation determined the information was accessed and/or viewed, it could not confirm if the information was downloaded or otherwise acquired by an unauthorized user.”

ComplyRight is not the only HR services firm hit by a data breach recently. Australia-based PageUp reported last month that hackers may have gained access to names, contact information, usernames, and password hashes. PageUp says it has 2.6 million active users across over 190 countries.