After discovering a security breach that gave hackers access to sensitive information, including bank account data, Paytime Inc. plans to contact employees of affected clients starting next week.
Chris Haverstick, Paytime's vice president of sales and marketing, said the company understands the urgency of the situation and is doing everything it can to provide the employees with credit monitoring as soon as possible.
"We will be mailing letters to employees that provide access to credit monitoring and identity restoration services beginning on May 21," he said.
Paytime needs the time between now and then to obtain permission from clients to notify affected employees and to establish the call center and other resources, Haverstick said.
Haverstick also confirmed the scope of the breach, as Paytime noted in a letter to clients: “Names, Social Security Numbers, direct deposit bank account information (if provided), dates of birth, hire dates, wage information, home and cell phone numbers, other payroll related information and home addresses were accessed by the intruders. There is also a possibility that information related to corporate bank accounts associated with your payroll was accessed."
The company, which is based in Upper Allen Township, said it discovered a compromise of user names and passwords related to its client service center on April 30 and began investigating immediately. So far, its crew, along with third-party IT forensic experts and law enforcement, have determined that the intruders — "skilled hackers working from foreign IP addresses" — first gained access to Paytime’s systems April 7.
"These intruders identified and exploited a vulnerability in Paytime’s Client Service Center, which allowed them to access employee information. Paytime has since run multiple tests to confirm security, and have also implemented new monitoring and intrusion detection systems," Paytime said in a written statement.
According to that statement, Paytime began notifying clients Monday and says it will provide resources needed to respond to the incident, including giving clients' employees access to one free year of credit monitoring, call center support and identity restoration services in the event any employee discovers fraudulent activity.
Business Journal records say Paytime issued 85,000 W2s in 2012, the most recent year for which the information was available. Discovery of the breach came shortly after an April 28 move that consolidated Paytime's two offices into one.