Chemonics Data Breach Affects 263,136 Individuals, Exposing SSNs

Chemonics International, Inc. recently experienced a significant data breach. The breach was initially discovered on December 15, 2023, when suspicious activity was detected in certain user accounts.

Following an investigation, it was revealed that unauthorized access to sensitive data began on May 30, 2023, and continued until January 9, 2024.

The breach exposed the personal information of 263,136 individuals across the United States. This includes 30 individuals in Maine and 179 individuals in Massachusetts.

The types of information compromised in the breach are highly sensitive and include:

• Social Security numbers
• Medical records
• Financial account details
• Driver's license numbers
• Credit and debit card numbers

The breach occurred due to unauthorized access to Chemonics' systems. The company’s internal security team identified the issue, reset passwords, and disabled impacted accounts. However, the investigation revealed that data had already been accessed during the months-long intrusion.

The breach was disclosed to the Maine Attorney General’s Office on December 5, 2024, and to the Massachusetts Attorney General’s Office on December 3, 2024.

Chemonics International's response

Chemonics has taken several steps to address the breach and improve its cybersecurity measures. Upon discovering the incident, the company conducted password resets and disabled the affected accounts. It also engaged cybersecurity experts to investigate the breach and determine its scope. In addition, Chemonics has been working with law enforcement authorities to address the incident.

To prevent future breaches, the company has implemented stronger multi-factor authentication processes, enhanced email security protocols, deployed advanced endpoint monitoring and detection tools, and blocked suspicious internet traffic. Chemonics is also offering affected individuals complimentary access to Equifax Credit Watch Gold for 24 months, which includes identity theft protection and credit monitoring services.

If you are affected by the data breach

If you have been notified by Chemonics that your information was part of this breach, it is essential to take immediate steps to protect yourself. Given the sensitive nature of the exposed data, including Social Security numbers and financial information, the following actions are recommended:

1. Enroll in the provided credit monitoring service: Chemonics is offering 24 months of Equifax Credit Watch Gold. Use the activation code provided in your notification letter to enroll before the deadline.
2. Monitor your financial accounts: Regularly review your bank and credit card statements for unauthorized transactions. Report any suspicious activity to your financial institution immediately.
3. Obtain your free credit report: You can access a free credit report from AnnualCreditReport.com. Review it carefully for unfamiliar accounts or inaccurate information.
4. Consider a credit freeze or fraud alert: A credit freeze prevents new accounts from being opened in your name, while a fraud alert notifies creditors to verify your identity before extending credit. Contact the three major credit bureaus—Equifax, Experian, and TransUnion—to set these up.
5. Be vigilant against phishing attempts: Scammers may attempt to exploit this breach by impersonating Chemonics or other trusted entities. Avoid clicking on links or providing personal information in unsolicited emails or phone calls.
6. Review the additional steps provided by Chemonics: Refer to the "Additional Steps to Protect Your Personal Information" document included with your notification for further guidance.

If you have further questions or concerns, Chemonics has set up a dedicated helpline at 1-888-658-8864, available Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Time.