CNY Works

CNY Works, also known as CNY Works, is a New York-based employment nonprofit organization that provides workforce development and employment services to clients within its regional market. The organization handles sensitive personal information for the individuals it serves, including names and Social Security numbers, as part of its core mission to assist job seekers. Its operational scope is centered on serving the employment needs of approximately 56,000 clients, a figure explicitly tied to the population potentially affected by a significant security incident. This scale indicates a substantial footprint within its specific geographic and service domain, processing a considerable volume of personally identifiable information necessary for employment support programs.

In December 2019, the organization experienced a ransomware attack that encrypted files on its servers. The incident potentially exposed the personal data of its clients, prompting the engagement of external cybersecurity professionals to conduct a forensic investigation. The organization restored its systems and data from existing backups, a critical operational control that mitigated data loss. The investigation concluded with no evidence that the attackers accessed or exfiltrated personal information prior to the encryption, though the motive was assessed as financially driven. Notification to affected individuals was delayed until the investigation's completion, which identified the impacted clients months after the initial discovery. Despite the absence of confirmed data theft, the organization proactively offered complimentary credit monitoring services to all potentially affected individuals as a precautionary measure against identity theft. No ransom demand was received in connection with the encryption event.