State Police investigating data breach affecting Maine's law enforcement agencies

The Maine State Police are currently investigating a data breach that affects information shared by law enforcement agencies statewide, through the Maine Information and Analysis Center (MIAC).

"The MIAC was notified on June 20th of a data breach by Netsential, a company that provides third-party web hosting services to over 200 law enforcement and government agencies throughout the United States. We were told this data breach may have included information from the MIAC, consequently, we notified our partner agencies of the possible data breach with recommendations on mitigation measures, such as creating awareness for phishing attacks and changing passwords. Since then, the MIAC has been working to assess the extent of the data breach with our state, local and federal partners, including the FBI Houston Field Office, which is actively investigating this incident," says Lt. Michael Johnston, of the Maine State Police.

Johnston says they received confirmation that datasets submitted to the MIAC by partner organizations and maintained by Netsential have been compromised and made public through various unlawful means.

"Our initial analysis revealed some of these files contain information distributed among law enforcement and government agencies. The MIAC has been utilizing the services of this vendor since 2017. We will be engaging in additional, more specific notifications to those agencies affected as we learn what the contents of those breaches are, to ensure that ongoing investigations are not jeopardized," says Johnston.

The most common documents shared are crime information and situational awareness bulletins that are used to assist in solving crimes, to connect regional incidents and to create situational awareness for public safety entities and private sector partners throughout the state. Johnston says these bulletins often contain identifying information, such as full name and date of birth of people under investigation by other law enforcement agencies. They may also involve individuals wanted for criminal activity or individuals reported as missing.

"We will be engaging in additional, more specific notifications to those agencies affected as we learn what the contents of those breaches are, to ensure that ongoing investigations are not jeopardized," say Johnston.