Retirement database cracked, does the company have to buy credit protection?

So word has quietly leaked to me a public sector company I used to work for had their online retirement database attacked and cracked, twice.

This happened in late December and the company is now getting around to letting the victims know.

I haven't got my letter yet, however a few of my x-co-workers have. In the letter, there is no mention of the company purchasing credit monitoring.

I looked around online for some sort of law requiring them to purchase credit monitoring. I wasn't able to find anything. Is ther any federal law that forces them to purchase credit monitoring?

The reason I ask is that this is the 2nd time this has happened to me. The first time, I did get credit monitoring for one year, at the company's cost.

Thanks

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

Hypntick

Don't know if it's a law or not, it should be. I think it's mostly just the right thing to do, kind of a "Our bad, sorry we screwed up" measure. I'd keep an eye on your stuff though even if they don't.

eMeS

JockVSJock wrote: »

Is ther any federal law that forces them to purchase credit monitoring?

No, but if they were sued and settled, or lost the case, then the terms of the settlement could require this.

MS