On February 9, 2024, California officials reported that a security breach of California's welfare benefits program, BenefitsCal occurred, resulting in the unauthorized access to over 19,000 user accounts. It’s believed that threat actors waited a few weeks after getting ahold of the passwords before reusing them—which are thought to have been acquired from third-party websites. The length of the breach is no joke. It’s thought that it was a slowly executed attack, believed to have taken place between March 1, 2023, and February 13, 2024.
What this really means, is that the users who were victims of this breach likely used a password for their account that they used on another one. This gives attackers the ability to perform credential-stuffing attacks, which are rather lucrative. While back in the old days someone may be hiding in a dark room manually entering the login credentials into various websites, they no longer have to perform that “labor of love.” There are tools they can use that allow that process to be automated and done very quickly. In 2021, some attackers (dubbed Proxy Phantom) used bot-based attacks, performing as many as 2,691 login attempts per second!
The compromised information potentially included names, addresses, dates of birth, Social Security numbers, email addresses, phone numbers, EBT card numbers, case numbers, Medi-Cal ID numbers, and program eligibility details. So, basically everything stored in the account.
In response, BenefitsCal temporarily deactivated affected accounts, reissued EBT cards, launched an investigation, and implemented additional security measures, such as adding two-factor authentication (2FA). This could be a one-time code sent to an email address or phone number, a biometric identifier such as fingerprint, or use of a hardware key small enough to fit in that tiny little pocket of your jeans for which no one really knows the reason it’s there. If you have the option to enable 2FA for this or any online account, take advantage of it.
They also advised users to create strong, unique passwords for each website used. This typically means using at least eight characters and includes a good mix of letters, numbers, and special characters. And whatever you do, don’t use one that’s been used on another website!
BenefitsCal has not yet stated whether or not credit monitoring will be made available. If it is and you’re a victim of this attack (or any time it’s made available to you), take advantage of it. However, don’t double up. Instead, when the time runs out on one, start up another and have continuous coverage.
Also remember that credit monitoring will not prevent someone from opening up fraudulent accounts with your information. It will alert you if someone does. Then you can contact the credit reporting agencies (Equifax, Experian, TransUnion) and let them know. If you don’t need access to your credit report, consider freezing it. In fact, consider this anyway. You can freeze and unfreeze them at no charge.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
