Ransomware attack on Forward Air may have exposed sensitive employee data

The devastating ransomware attack that hit Forward Air Corp. in December may have exposed sensitive personal information of current and former employees, according to data breach notices sent by the trucking giant.

The Tennessee-based firm sent letters to the attorney general offices in at least four states — California, Vermont, Montana and New Hampshire — on Sept. 24 as it began notifying the affected people. They warn that information including names, addresses, birthdates, and Social Security, driver’s license, bank account and passport numbers could have been “subject to unauthorized access” in November and early December.

The notices don’t explicitly refer to the December ransomware attack, which crippled Forward’s (NASDAQ:FWRD) systems and operations. But they state that the company uncovered the potential data exposure while investigating “suspicious activity” detected on its systems on or around Dec. 15 — the date that the company says it first became aware of the ransomware attack. 

“At this time there is no indication that anyone’s information has been subject to actual or attempted misuse,” Forward Chief Information Officer Jay Tomasello wrote in a letter being sent to affected people, which also offers free credit monitoring for a year. “Nevertheless we are informing you because your information was stored on our systems.”