Lorain County Board of Commissioners

In May 2024, the Lorain County Board of Commissioners disclosed a data security breach where an unauthorized party accessed internal records on the Lorain County Auditor’s network. The incident exposed sensitive personal and financial information of county employees and vendors, including Social Security numbers, bank account details, and routing numbers. While no fraudulent activity was detected at the time, officials urged affected individuals to monitor their financial statements for suspicious transactions. The breach prompted a temporary shutdown of most county networks as a precautionary measure, though critical infrastructure (including 911 and emergency services) remained operational. Systems were fully restored by June 2. The attack did not disrupt county operations significantly but raised concerns over potential identity theft and financial fraud targeting employees and third-party vendors. The exposure of such sensitive data poses risks of phishing, unauthorized transactions, and long-term reputational damage to the county administration.

Source: https://www.cleveland.com/news/2025/09/lorain-county-data-breach-may-have-exposed-employee-and-vendor-social-security-bank-information.html

TPRM report: https://www.rankiteo.com/company/lorain-county-government

"id": "lor4193041092225",
"linkid": "lorain-county-government",
"type": "Breach",
"date": "5/2024",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': 'Employees and vendors (number '
                                              'unspecified)',
                        'industry': 'Public Administration',
                        'location': 'Elyria, Ohio, USA',
                        'name': 'Lorain County Board of Commissioners',
                        'type': 'Government'},
                       {'industry': 'Public Administration',
                        'location': 'Elyria, Ohio, USA',
                        'name': 'Lorain County Auditor’s Office',
                        'type': 'Government Department'}],
 'data_breach': {'data_exfiltration': 'Potential (investigation ongoing)',
                 'personally_identifiable_information': ['Social Security '
                                                         'numbers',
                                                         'bank account numbers',
                                                         'routing numbers'],
                 'sensitivity_of_data': 'High (Social Security numbers, bank '
                                        'account details)',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)',
                                              'Financial Data']},
 'date_detected': '2024-05-23',
 'date_publicly_disclosed': '2024-06-07',
 'date_resolved': '2024-06-02',
 'description': 'An unauthorized party gained access to internal records on '
                'the Lorain County Auditor’s network, potentially exposing '
                'personal information of county employees and vendors, '
                'including Social Security, bank account, and routing numbers. '
                'Critical infrastructure was not compromised, but most county '
                'networks were briefly taken offline as a precaution. No fraud '
                'has been detected, but officials advise reviewing financial '
                'statements for suspicious activity.',
 'impact': {'brand_reputation_impact': 'Potential reputational risk due to '
                                       'exposure of sensitive data',
            'data_compromised': ['Social Security numbers',
                                 'bank account numbers',
                                 'routing numbers'],
            'downtime': 'Brief outage (most county networks taken offline as '
                        'precaution)',
            'identity_theft_risk': 'High (personal and financial data exposed)',
            'operational_impact': 'Minimal (emergency services, including 911, '
                                  'remained fully operational)',
            'payment_information_risk': 'High (bank account and routing '
                                        'numbers exposed)',
            'systems_affected': ['Lorain County Auditor’s network']},
 'initial_access_broker': {'high_value_targets': ['Auditor’s network records']},
 'investigation_status': 'Forensic investigation completed (no fraud detected '
                         'as of disclosure)',
 'recommendations': ['Monitor financial statements for suspicious activity'],
 'references': [{'source': 'News 5 Cleveland (WEWS-TV)'}],
 'response': {'communication_strategy': ['Public announcement on 2024-06-07',
                                         'Advisory for employees and vendors '
                                         'to review financial statements'],
              'containment_measures': ['Networks briefly taken offline as '
                                       'precaution'],
              'incident_response_plan_activated': True,
              'recovery_measures': ['All systems restored by 2024-06-02'],
              'third_party_assistance': 'Forensic investigation conducted '
                                        '(details unspecified)'},
 'stakeholder_advisories': ['Employees and vendors advised to review financial '
                            'statements'],
 'threat_actor': 'Unauthorized party (unknown)',
 'title': 'Lorain County Board of Commissioners Data Security Incident',
 'type': 'Data Breach / Unauthorized Access'}