The Ohio lottery data breach affected over 538,000 people.

On Christmas Day, the Ohio lottery system was subjected to a cyberattack, resulting in the personal data of over 538,000 individuals being made accessible to criminals. On December 24, 2023, a security breach occurred, affecting the data of 538,959 users. The organization's management is notifying the affected individuals about the incident. Hackers were able to access data such as names and other unique personal identifiers along with social security numbers.SSNIn the security breach notification sent to affected users, it is stated: "Around December 24, 2023, the Ohio lottery recorded unauthorized access to our internal network, which led to a data leak of information in our possession. This incident did not affect the gaming network platform." The message also states: "After a thorough forensic investigation and manual document review, we determined on April 5, 2024, that some files containing your personal information were subject to unauthorized access."

To protect the victims from potential consequences of the information leak, the Ohio Lottery offers free credit monitoring and identity theft protection services through IDX.

A group of hackersDragonForceI took responsibility for this attack and the theft of 94 gigabytes of data. In their message on an anonymous resource on the Tor network, it is stated: "Long negotiations, which seem to have led nowhere, resulted in the collection of 1,500,000 records containing information about Ohio lottery customers."SSN"Date of Birth). This accounts for about 12% of the population of Ohio, and the data is just our conservative estimates."

Hackers added: "For your convenience, we have exported the records from the database into a user-friendly CSV format, and you also have the option to download full copies of the databases. The Ohio Lottery has been warned about the potential consequences for people, but apparently, this doesn't concern them too much; it's a consequence of negligence." Follow me on Twitter:@securityaffairsand also on Facebook and MastodonPierluigi Paganini (Security Affairs- hacking, cybercrime).