Ohio Lottery shares details about cybersecurity incident

The Ohio Lottery has suffered cybersecurity incident, revealing the sensitive information of over 500,000 people.

In December 2023 the Ohio Lottery confirmed that it was forced to shut down several key systems to contain a cyber hit that affected how it pays out some prizes. Now, it reported the breach to the Maine Attorney General's office, sharing more details about the incident.

Ohio Lottery detected unauthorized activity in its internal office network, which exposed customers’ personal information.

The information involved includes:

• Full names
• Social Security numbers

The organization investigated the incident, working with cybersecurity experts to examine the incident. The breach didn’t impact the gaming network.

“After an extensive forensic investigation and our manual document review, we learned on April 5th, 2024, that certain files containing your personal information were subject to unauthorized access,” Ohio Lottery said.

There’s no evidence that any personal information accessed has been misused, the organization states.

Ohio Lottery is providing affected customers with 12 months of free credit monitoring and identity theft protection through IDX.

Ohio Lottery is a state lottery run by the Ohio Lottery Commission. It offers various games, including scratch tickets, numbers games, classic lottery, and rolling cash.

According to its website, “One hundred percent of Ohio Lottery profits help support K-12, vocational, and special education programs in Ohio.”

An attack on Christmas Eve affected an undisclosed number of internal applications, the Ohio Lottery said.

Even though the gaming system was still fully operational, the lottery said that mobile cashing and prize cashing above $599 was unavailable.

The attack was supposedly claimed by the fairly new DragonForce ransomware gang.

The threat actors claimed to have encrypted devices and stolen data, including Social Security numbers and dates of birth. The allegedly stolen files contained information belonging to Ohio Lottery customers and employees.

Updated on May 11th. The previous version of this article incorrectly stated that Ohio Lottery suffered another cybersecurity breach when, in fact, the breach notification letter to authorities refers to the same breach that Cybernews reported in December, 2023.