About Worcester Regional Retirement System
The Worcester Regional Retirement System (WRRS), a government entity based in Auburn, MA, experienced a data breach affecting 15,805 individuals, including 150 Maine residents. The breach, resulting from an external system hacking, was discovered on October 20, 2025, several months after it occurred on June 10, 2025. The personal information accessed included names, Social Security numbers, and other sensitive data. The organization has notified affected individuals and taken steps to mitigate further risks.
What Happened
On or around June 10, 2025, WRRS experienced a network disruption and immediately initiated an investigation of the matter. WRRS engaged independent cybersecurity experts to assist with the process. As a result of the investigation, on or around September 15, 2025 WRRS determined that certain information may have been accessed and acquired without authorization. WRRS undertook a comprehensive review of those files and, on or about October 10, 2025 learned that some of your personal information was contained within the potentially affected data which is the reason for this notification. Please note that WRRS has no evidence of the misuse, or attempted misuse, of any potentially impacted information.
The breach primarily impacted individuals whose personal information, such as Social Security numbers and medical information, was accessed without authorization. The breach occurred on June 10, 2025, and was discovered on October 20, 2025.
Next Steps
WRRS has sent written notifications to the affected individuals as of October 20, 2025. Those impacted should closely monitor their accounts and credit reports for any suspicious activity. It is recommended to report any unauthorized transactions or identity theft to the relevant authorities promptly. Additionally, individuals can consider placing a fraud alert or security freeze on their credit reports to prevent further misuse of their information.
Identity Theft Protection Services
As a precaution, WRRS is offering complimentary identity protection services through IDX to the impacted individuals. These services include 12 months of credit monitoring, dark web monitoring, and a $1 million identity fraud loss reimbursement policy. Additionally, fully managed identity theft recovery services are available to help individuals manage any potential repercussions of the data breach. Affected individuals are encouraged to enroll in these services by January 20, 2026, to take full advantage of the protection offered.