Warrior Met Coal Says Data Breach Compromised Personal Information Of Nearly 20,000

BROOKWOOD, AL — Warrior Met Coal this week informed the Maine Attorney General's Office that the names and Social Security numbers of nearly 20,000 individuals have been compromised by a recent data breach intended to extort money from the west Alabama metallurgical coal producer.

Click here to subscribe to our free Tuscaloosa Daily newsletter and breaking news alerts

According to the details of the data breach provided to government officials, the data breach occurred on July 29 and was discovered the same day. The company notified those impacted this week and said it has taken steps to mitigate the risk moving forward.

Without providing much in the way of specifics, the Brookwood-based coal producer reported that 19,794 individuals had been affected.

Warrior Met then elaborated on the breach, saying it was the result of a highly sophisticated type of malware that evaded detection by the company's anti-virus software.

Once the breach was discovered, the company says it took those systems offline, before notifying law enforcement and engaging cybersecurity experts to investigate.

"Over the course of the following few weeks, we determined that a criminal threat actor evaded our cybersecurity defenses and acquired files containing your personal information," Warrior Met Coal said in a letter notifying those impacted by the breach. " We have recovered the files."

The number of Alabama residents affected by the data breach remains unclear, with each state having different laws that govern how data breaches are reported.

For example, entities in Maine are required to report data breaches to the state's attorney general, who then makes the basics of the breach publicly available online — information like the number of residents affected.

According to the report for the Warrior Met Coal data breach, only four Maine residents saw their personal information compromised.

Alabama passed its first data breach notification law in 2018 and requires companies or institutions to notify the state attorney general if more than 1,000 Alabama residents are impacted. While these entities are bound by law to report large data breaches, the information is not made available by the state for public consumption.

Have a news tip or suggestion on how I can improve Tuscaloosa Patch? Maybe you're interested in having your business become one of the latest sponsors for Tuscaloosa Patch? Email all inquiries to me at ryan.phillips@patch.com