In Ms. Litan’s view, the federal government has not devoted sufficient resources to secure its systems against cybercrime and identity theft.
Some of the schemes, like those that hit Washington State in the spring, were linked by federal investigators to a Nigerian-based criminal ring called Scattered Canary. The ring used stolen Social Security numbers and other identity theft, and was suspected of operating in North Carolina, Massachusetts, Rhode Island, Oklahoma, Wyoming and Florida.
Washington State officials shut down the unemployment system for two days in mid-May as part of an effort to halt illegitimate payments that ended up totaling $576 million. The state has recovered $346 million so far.
Parker Crucq, a senior threat intelligence analyst at Recorded Future, said the number and types of perpetrators had grown, ranging from organized networks and technological whizzes to bush-league hucksters.
“While many of these threats require knowledge of social engineering techniques, they likely do not require a degree of technical sophistication,” Mr. Crucq wrote in an assessment of unemployment insurance schemes. “This means that there is a low barrier to entry for potential scammers and criminals who are interested in getting involved with this form of fraud.”
In hacker forums and on the so-called dark web, where users can hide their identity and location, “some of these actors are specifically calling out state agencies by name, boasting that it’s quite easy to fill out applications on multiple occasions from information scraped from previous data breaches,” he said.
Over three weeks in September, the police in Beverly Hills, Calif., arrested 87 people from states as far away as Alaska and New York on charges related to unemployment insurance fraud. The accused were not working in tandem but followed a similar pattern, applying for benefits with Social Security numbers stolen from people who had died or were in prison or nursing homes, said Lt. Max Subin, a department spokesman.