Elmore County

Elmore County, Idaho, notified the Attorney General on December 14, 2022, of a breach discovered on December 13, 2022. A malicious actor exploited an isolated computer at the Elmore County Fair Grounds, possibly via a backdoor, to send a phishing/malware email to approximately 730 recipients (490 external, 240 internal). The incident resulted in the release of personal identifying information of employees and others.

Affected (this filing): 730

Elmore County, Idaho, filed an update to its data breach notification on December 15, 2022, reporting two additional email account breaches discovered on December 14, 2022. The breaches involved employee email accounts from the Juvenile Probation Office and the Sheriff's Office. The same threat actor responsible for a prior breach on the county fairgrounds computer compromised these accounts. The county retained forensic firm Sylint and outside counsel to investigate, preserve evidence, and notify recipients of malicious messages.