The laboratory was alerted to the breach in the early morning hours of Nov. 20, 2023.  

The laboratory was alerted to the breach in the early morning hours of Nov. 20, 2023.   

Like many organizations, INL relies on cloud-based systems to perform certain business operations. Oracle is a Department of Energy-approved cloud-based vendor that supports our Human Resources applications like payroll and benefits administration. In this case, the data breach occurred offsite on a federally approved cloud-based system that contained INL data and that was supported by a subcontractor. The test environment of the cloud-based system was accessed by a threat actor who stole sensitive data and posted it online. INL’s own network was not breached.

INL has finalized a contract with Experian to provide no-cost credit monitoring to all individuals (including employees, spouses and dependents) impacted by the data breach. Impacted individuals will receive a joint letter from Experian and INL soon with details on how to enroll in this service, as well as the types of personal information impacted by the data breach.

Contact financial institutions listed in your Oracle HCM profile on June 1, 2023, and follow their recommendations for account safety. Keep an eye on your financial accounts (bank, credit card, shopping) for suspicious activity. Consider updating passwords or implementing multifactor authentication if you don’t already have it in place.

No. The breach only impacted the cloud-based Oracle HCM test environment that resides off-site. 

A well-known hacking organization has taken responsibility via social media, but a full investigation must be completed to confirm this information.

In the immediate aftermath of the event, INL worked to restrict access to the environment involved in the breach, alerted federal law enforcement agencies, and began confirming the individuals and the types of information that were compromised. We also worked to notify impacted individuals through internal and external means and provided recommendations to minimize the impact. The laboratory also alerted stakeholders including the Department of Energy, and local, state and federal elected officials. 

INL is working with Experian to provide comprehensive, no-cost credit monitoring, identity restoration and identify fraud insurance to all individuals (including employees, spouses and dependents) impacted by the data breach. Impacted individuals will receive a joint letter from Experian and INL soon with details on how to enroll in this service.  

Investigations are ongoing and further information about the data breach and future actions will be shared when possible.  

We can confirm the release of information for employees (including postdocs, graduate fellows and interns), dependents and spouses in the data breach. Currently, we have not seen any data for subcontractor employees. Multiple forms of sensitive personally identifiable information (PII) including names, social security numbers, salary information and banking details were impacted as outlined below. Impacted employees will receive a joint notification letter from Experian and INL soon.  

• Those who were actively employed on June 1, 2023: These individuals have information, including multiple forms of sensitive PII, in the data set impacted in the breach.
• Employees who began active employment after June 1, 2023: These individuals did not have any data impacted by the breach.
• Employees who left INL after June 1, 2023: Individuals who left INL for any reason after June 1, 2023, (e.g., retirement, voluntary or involuntary separation, etc.) have information, including multiple forms of sensitive PII, impacted by the breach.
• Dependents and spouses of employees who were actively employed on June 1, 2023, and/or who left INL after June 1, 2023: These individuals have information, including names and dates of birth, in the data set impacted in the breach. 
• Previous employees, (including retirees, interns, grad fellows and postdocs) and their dependents/spouses: We can confirm that names and dates of birth for these individuals were impacted. For some previous employees, we know that other sensitive PII was also exposed. 

Yes. INL is working with the Department of Energy, the Federal Bureau of Investigation, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, and other national labs to investigate the breach. 

Recommended steps for those who may have been impacted include: 

• Placing a free credit freeze on your credit report. This will prevent unauthorized access to your credit history and credit score and prevent an unauthorized individual from taking out a loan or opening new lines of credit in your name. Individuals must establish an online account at each of the U.S. Credit Reporting Agencies: Equifax, Transunion, Experian, Innovis, and National Consumer Telecom and Utilities Exchange.
• Contact financial institutions listed in your Oracle HCM profile on June 1, 2023, and follow their recommendations for account safety. Keep an eye on your financial accounts (bank, credit card, shopping) for suspicious activity. Consider updating passwords or implementing multifactor authentication if you don’t already have it in place. 
• Review your credit reports using sources like Annual Credit Report.com. 
• Be on guard for identity theft. More information on this topic is available from the Federal Trade Commission and gov.
• Watch your email, text messaging, social media and phone calls for highly targeted phishing attempts that take advantage of this information. Many cybercriminals prefer to launch attacks on weekends and around the holidays.
• The Federal Trade Commission can help you develop a customized identity theft plan. Visit gov, click “Get Started,” and then select “My information was exposed in a data breach.”
• During tax season, bad actors submit tax returns to the IRS and divert refunds to their bank account. The IRS has created a Taxpayer Guide to Identity Theft that may be useful. The IRS also recommends creating an identity protection PIN, but this option is not open until January.

Our investigation is ongoing, but at this time, we have seen limited retirement information included in the breach. The only data included was whether an employee is enrolled in the retirement plan. We have not seen any retirement account details included in the breach.

To help ensure that your information is not compromised, you may want to consider taking advantage of the following security features from Vanguard.

Experian has the capability to cross check addresses and address change requests with the United State Postal Service to ensure the most current address is on file for each individual.

Unfortunately, some deceased individuals and some former employees that live outside the U.S. were also impacted by the data breach. For families of deceased loved ones, we recognize that this presents a unique challenge and we have asked for resources to help. Experian has provided guidelines on Protecting Deceased Individuals to help these families protect their deceased loved ones from identity theft. Families and estates may also contact INL’s Privacy Office at [email protected] with additional questions or for more information.

A small number of former INL employees impacted by the data breach currently reside outside of the U.S. In these countries, identity protection laws and resources vary. Individuals who live outside the U.S. and wish to speak with someone about coverage options can contact INL’s Privacy Office at [email protected].

If you have difficulties registering for Experian’s no-cost, comprehensive credit monitoring, identity theft, and identity restoration services, or receive an invalid access code notification while registering, Experian has provided the following information to assist in the process:   

An invalid code error will appear in the following circumstances:

1. The code is entered incorrectly, such as lowercase instead of capitalized letters.
2. The individual has already initiated the product but closed the browser before finalizing authentication (at that point the code is “burned,” and a fresh membership cannot be initiated). 
   • In this case, the person should call Experian using the phone number listed in the enrollment letters to verify their identity and gain access to the membership. 
3. Some browsers trigger the error if the page has been cached. Clearing the browsing history usually fixes the error.
4. The individual is using a different URL than the one provided in their letter when trying to enroll.

If you experience any other issues while registering for service, call the Experian phone number listed in your letter for assistance.