California Public Employees' Retirement System

San Francisco Employees' Retirement System (SFERS) notified the California AG of a data breach involving its vendor, 10up Inc. On Feb 24, 2020, an outside party accessed a test server containing data for ~74,000 SFERS members. The vendor discovered the access on March 21, 2020, and notified SFERS on March 26, 2020. Exposed data included names, addresses, dates of birth, beneficiary info, and for registered users, security questions/answers and bank routing numbers. SSNs were not involved. SFERS reset passwords and offered credit monitoring.