American Payroll Institute, Inc. (APA); Global Payroll Management Institute, Inc. (GPMI)

American Payroll Institute (APA) disclosed a skimming cyberattack on its website discovered July 13, 2020, with activity dating back to May 13, 2020. A vulnerability in APA's content management system allowed a skimmer to be installed on the login and checkout pages. Unauthorized individuals accessed login credentials and payment card information, along with PII including names, addresses, and job details. APA patched the CMS, installed antivirus, increased patch frequency, and mandated password resets. Affected individuals received 12 months of credit monitoring via Equifax.