The stolen information comprises Social Security numbers, physical addresses and bank routing numbers.
According to the WBJ among the breached servers are those that contain data from the Superfund program, which was set up for managing the cleanup of abandoned hazardous waste sites.
An EPA employee confirmed that the compromise was the result of an attack that started with the opening of a malicious email attachment on a computer that had access to the servers, but declined to say whether the computer was operated by an agency employee or a contractor.
"EPA conducted a risk analysis, [which] indicates it is unlikely the personal financial information has been used," the agency shared in the statement. "Vigilantly keeping data secure from increasingly sophisticated cyber threats is a top priority at EPA. The agency has already added new safeguards in response to the incident."
But the most worrying thing about this breach is that it happened in March, and the affected individuals have been notified only now. The agency has offered free credit-monitoring services for one year to all of them, but has yet to say why it took so long for the breach notification to be delivered to them.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.