Arizona lawmakers have got hacked this week. And when they just clicked the link to change their password, a screen with Russian writing had been popped up.
Arizona Chief Information Security Officer Mike Lettman has sent an email to legislative staff on Friday night alerting them to the issue. According to the email, multiple senators or staff have received an email which appeared to be from the state's human resources and payroll system asking to reset their password. When someonehad clicked on the link, they received a screen in Russian.
Lettman said in the email, "At this point at a minimum anyone who clicked on the link or changed their HRIS (Human Resources Information Solution) password has their login and password compromised. In addition clicking on the link may have compromised their desktop or laptop was infected to begin with."
He said in the email that the Arizona Department of Administration has already shut down all external access to the system until the extent of the problem has been determined. The system handles HR and payroll issues for 40,000 state employees and calculates $2.5 billion in annual payroll, according to the ADOA website. It's not yet clear if other state employees had also been impacted.
Arizona legislature gives privilege to hearing difficulty!
Several state lawmakers have confirmed they had received the warning email, along with that they couldn't get into the payroll system this weekend.
Wendy Baldo, the Senate chief of staff, said that at least two people on her staff has got an email from HRIS late in the week telling them that their password would expire soon and they needed to change it.
Senate Republican Assistant General Counsel and Policy Advisor Jeff Kros was one of them. When he hit the “change password” prompt, it popped up in Russian.
Baldo said she then looked at her email, found the same email and checked it out with the same result.
Aside from a message from Legislative Council, which oversees legislative communications, Baldo said that she has not heard anything further about the origin of the email. She said, “I don’t expect any big interruptions, it’s just a crazy thing that happened.”
According to Arizona Department of Administration's initial assessment, the issue had been isolated to about 100 people at the state Legislature and there was no evidence at this point that anything other than login information might have been compromised.
By Prakriti Neogi
