State of Missouri

Summary

The state of Missouri experienced a cyber incident that led to the temporary shutdown of an employee portal used for managing payroll, health savings and deferred compensation accounts after suspicious activity was detected in a limited number of accounts. Officials reported that the breach affected a small subset of workers while the portal was taken offline and later restored with added multi-factor authentication safeguards. The incident occurred alongside other recent disruptions, including a hack that shut down the state’s conservation permitting system and a broader service outage tied to a third‑party cybersecurity provider that impacted driver‑license offices and a supplemental food program. Throughout this period, the state’s cybersecurity advisory commission, established in law but never populated with appointed members, faced scrutiny and a legislative proposal to eliminate it.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On December 23, information technology workers discovered unauthorized activity within the state’s employee self‑service portal, which they described as a hack seeking information about employee savings accounts. The portal, known as the ESS Portal, provides time‑off reporting, health savings account management, retirement information and deferred compensation services for approximately 54,000 Missouri state workers, including Highway Patrol troopers, social service employees and legislative staff. Upon detection, the Office of Administration’s information technology division placed the portal into maintenance to secure the systems, and officials stated that fraud protection systems blocked all unauthorized transactions. A spokeswoman for the administration said she would not characterize the incident as a hack, noting instead that a third‑party vendor had alerted the state to suspicious activity limited to a number of deferred compensation user accounts that officials believed were accessed via the portal. The outage occurred while employees were managing end‑of‑year financial tasks such as health savings account adjustments and holiday time‑off requests, creating an inconvenience for workers who could no longer use the centralized portal.

In response to the disruption, the state unveiled a new version of the portal that incorporates multi‑factor authentication to increase security. While the portal remained under maintenance, workers were instructed to access individual services directly by clicking on links to the specific information they needed, which required them to log in separately to each site. An announcement on the portal acknowledged the service interruption as an inconvenience and directed employees to the direct links while work continued on a resolution. Officials confirmed that 47 employee accounts out of more than 50,000 state workers were affected by the unauthorized access, and that the compromised activity was confined to deferred compensation accounts. The notice emphasized that the priority remained ensuring uninterrupted and confidential access to personal information for all state employees.

Beyond this incident, the Missouri Cybersecurity Commission, established by law in 2021 to meet at least quarterly, advise the governor on cyber threats, identify vulnerabilities and produce an annual report, has never had any members appointed by either former Governor Mike Parson or current Governor Mike Kehoe. The lack of appointments has been noted by legislators who argue that the commission is not functioning as intended. Separate from the portal event, Missouri experienced a hack in March that shut down the Department of Conservation’s systems, which handle hunting and fishing permits and manage nearly one million acres of public land, and in July 2024 a CrowdStrike disruption caused delays for driver‑license renewals and food‑benefit access, temporarily affecting driver‑license facilities and the Women, Infants and Children (WIC) program at the Department of Health and Senior Services.

Legislative action concerning the commission’s future emerged when Senator Mary Elizabeth Coleman introduced Senate Bill 890, proposing to eliminate several state boards and commissions, including the Missouri Cybersecurity Commission, on the grounds that no members had been appointed and the board was not meeting. The bill advanced from the Senate Government Efficiency Committee to the full Senate for further debate. House Minority Leader Ashley Aune, a co‑sponsor of the commission’s creation, expressed disappointment at the potential elimination, emphasizing the importance of forward‑looking cybersecurity efforts for state government. The commission’s statutory responsibilities, including quarterly meetings and annual vulnerability reporting, remain unchanged in law despite the ongoing discussion about its possible dissolution.

Sources

Sources available to members: 2 sources.