CBIZ, INC.

SALE

CBIZ, Inc. filed a supplemental notification with the New Hampshire Attorney General regarding the MOVEit security incident. The company mailed notification letters to 3,238 New Hampshire residents whose personal information was involved. CBIZ is offering complimentary credit monitoring and identity theft restoration services through Kroll.

CBIZ, Inc. experienced an external system breach between May 29, 2023, and June 5, 2023, discovered on August 10, 2023. The breach affected 482 Maine residents, compromising names and financial account or credit/debit card numbers with associated security codes or PINs. CBIZ offered credit monitoring and identity theft protection services to those affected.

CBIZ KA Consulting Services, LLC reported to HHS on 2023-11-10 a Hacking/IT Incident affecting 436,198 individuals. Breached information located on Network Server. A software application used by its vendor exposed PHI including names, DOB, addresses, SSN, driver's license, diagnoses, and financial/insurance data. The BA implemented additional administrative, technical, and security safeguards.

CBIZ, Inc. notified South Carolina residents of a data incident involving the MOVEit Transfer software provider, Progress Software. An unauthorized party exploited a vulnerability in MOVEit to access a CBIZ server and download data containing names, dates of birth, and Social Security numbers between May 29 and June 5, 2023. CBIZ patched the vulnerability and offered two years of identity monitoring.

CBIZ, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2023-09-01. 31,370 Massachusetts residents were affected. The report records the breach type as electronic.

CBIZ, Inc. notified individuals of a data incident involving MOVEit Transfer software. An unauthorized party exploited a vulnerability in MOVEit to access a server and download data between May 29 and June 5, 2023. Affected data included names, dates of birth, and Social Security numbers. CBIZ patched the vulnerability and offered two years of identity monitoring.

CBIZ, Inc. notified the New Hampshire Attorney General on September 1, 2023, regarding a MOVEit Transfer vulnerability exploited between May 29 and June 5, 2023. The incident affected 77 New Hampshire residents. CBIZ applied patches, investigated, and mailed notifications offering credit monitoring. Data exfiltrated included personal information.

CBIZ, Inc. experienced an external system breach between May 29, 2023, and June 5, 2023, which was discovered on August 10, 2023. The breach affected 35,843 individuals, compromising their names and Social Security numbers. CBIZ notified affected consumers in writing on September 1, 2023, and offered complimentary credit monitoring and identity theft protection services through Kroll.

CBIZ, Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2023-05-29 and was reported on 2023-09-01. 1,211 Indiana residents were affected. 35,843 individuals affected in total.

CBIZ, Inc. notified California residents of a data breach involving its IT environment for client Mayer Hoffman McCann P.C. An unauthorized third party exploited a vulnerability in Progress Software's MOVEit Transfer software, accessing a server between May 29 and June 5, 2023, and downloading data. Affected information includes names, dates of birth, and Social Security numbers. CBIZ patched the vulnerability and is offering two years of identity monitoring.

CBIZ, Inc. disclosed a data breach involving its MOVEit Transfer server, exploited via a vulnerability in Progress Software's software. Unauthorized access occurred between May 29 and June 5, 2023, resulting in the exfiltration of names, dates of birth, and Social Security numbers. CBIZ patched the vulnerability and offered two years of identity monitoring services.

CBIZ, INC. filed a data-breach notice with the Illinois Attorney General during 2023 (case 23-874). The register records the breach as discovered on May 29, 2023. Additional entities named: MOVEIT. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

CBIZ MHM, LLC notified the NH Attorney General of a security incident affecting one NH resident. Unauthorized access to an employee's email occurred May 21-22, 2018, discovered June 13, 2018. Data included names, SSNs, driver's licenses, and financial account numbers. Notifications sent July 19, 2018, with credit monitoring offered.

CBIZ MHM, LLC notified Montana residents of a phishing incident where an employee's email account was compromised between May 2 and May 23, 2018. Unauthorized parties may have accessed names and variable data. CBIZ secured the account, engaged forensic investigators, and offered one year of Experian IdentityWorks.

CBIZ MHM LLC reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-07-18. 6 Massachusetts residents were affected. The report records the breach type as electronic.