WHEDA informs approximately 2,100 people who may have been impacted by recent phishing attack

The Wisconsin Housing and Economic Development Authority (WHEDA) today announced that an unauthorized third party accessed up to three WHEDA email accounts and may have potentially gained access to personal information of an estimated 2,100 Wisconsinites in WHEDA’s single family mortgage program.

WHEDA Executive Director Joaquín Altoro said an investigation confirmed that the unauthorized third party gained entry into the WHEDA email accounts through a phishing attack.  As a result of the attack, the unauthorized third party obtained WHEDA user credentials, which may have allowed unauthorized access to personal information for some WHEDA customers who applied for single family loans.

Altoro said the incident occurred on or around Thursday August 22 and was discovered early the following Monday morning, August 26.  Upon learning of the incident, WHEDA’s IT personnel disabled access to the compromised email accounts and began an investigation.  In addition, Altoro said WHEDA alerted law enforcement officials about the incident and brought in forensic IT experts to examine the situation, determine how it happened and review the potential extent of the impact.

“This is the first time this has ever happened at WHEDA, and we take this very seriously.  We already invest significantly in information technology security and staff training, and we will be doing more of it in the future,” he said. “We regret that this happened and will work with those affected to reduce any chances for negative impacts.”

Altoro said it is possible that the unauthorized third party gained access to a range of customer information, such as names, social security numbers, driver’s license number or state identification number, and bank account numbers.  To date, WHEDA is not aware of any misuse of customer information as a result of this incident.

In addition, Altoro said WHEDA will provide one year of identity theft protection and insurance as well as credit monitoring at no charge to impacted customers through Experian IdentityWorks^SM.  He said that WHEDA also has established a toll-free telephone line through Experian for customers to call with questions – 1-833-704-9390.  He noted that WHEDA has reached out to all impacted customers with additional information and is also briefing the various financial institutions that participate in the WHEDA single family mortgage program.

Altoro noted that WHEDA has an information security program that is audited annually by an outside expert and includes a yearly internal security review of computer operating systems as well as regular employee training.  He also said there are regular investments in IT security upgrades, new hardware and software improvements.

“Security is a top priority for us at WHEDA, and we are committed to trying to make this a one-time only occurrence.  All it takes is for one person to take the bait for a phishing attack to be successful and we are working to prevent these attacks from succeeding in the future,” added Altoro.

Altoro said WHEDA will continue to monitor the potentially impacted accounts and added that the authority will take steps to further increase security around its email system.

“Unfortunately, financial providers are systematically attacked every day, and WHEDA is no different.  Thus far, we have been able to thwart attacks.  This marks the first-ever successful attack on WHEDA’s IT system.  If we need to do more to protect the integrity of our system, we will.  Once is enough to know that we must be vigilant always,” Altoro said.

WHEDA is an independent state authority, not funded by state tax dollars, that works with lenders to provide low-cost financing for housing and small business development in Wisconsin.  For more information on WHEDA programs, visit www.wheda.com.