The disclosure of a major data breach at Transport Workers Union Local 100 earlier this year was treated by many in the labor community as a distant problem, something that happens only to large organizations. That assumption deserves to be reconsidered. According to the breach notices filed with several state attorneys general, unauthorized access to the local's systems was maintained for nearly a week beginning in late January, and the personal information of 46,400 members, including names, dates of birth, Social Security numbers, and health insurance subscriber IDs, was exposed before the intrusion was contained. A ransomware group later claimed responsibility on the dark web. The full details of the event have been documented publicly, and they are worth reviewing by any leadership team that still assumes its member records are too modest to attract attention.
What makes this incident instructive is not the size of the local but the ordinary nature of what was taken. A union hall is, almost by definition, a repository of exactly the information that identity thieves value most. Membership rolls combine Social Security numbers with dates of birth, home addresses, dues histories, and in many cases grievance records or health plan information that members would never expect to see leaked. That data is typically held on aging file servers that were configured years ago and rarely revisited. In my years of working with labor organizations here in Louisiana, I have seen more than a few union offices where the same password has been taped to a desk since before I joined this industry. None of this is said to cast blame. It is simply the natural result of an office whose real mission is serving members rather than managing technology.
Why the Threat to Union Data Has Grown
The timing of the incident is also worth noting, because unions have become more visible in the national conversation this year. Organizing campaigns are being amplified through digital channels, contract negotiations increasingly involve new workplace technologies and artificial intelligence tools, and members now expect to pay dues and communicate with leadership online. Every one of those conveniences widens the attack surface. Phishing attempts that reference a contract dispute or dues increase are far more convincing than generic spam, because members expect such messages during an active campaign. At the same time, the technical bar for an attack has been lowered considerably, as ransomware operations now function as commercial enterprises with toolkits offered to affiliates with little genuine skill. A local with a part-time IT arrangement and no continuous monitoring is, in that environment, not too small to matter. We have written before about cybersecurity risks specific to labor unions, and the pattern observed since then has only reinforced that concern.
What Union Leadership Should Be Doing Now
The practical response does not require an enormous budget, but it does require sustained attention. Member data should be inventoried so that leadership actually knows where the sensitive files live and who can reach them. Multi-factor authentication should be required for every account that touches dues processing or membership databases, and the older text-message methods should be replaced, a shift that has been accelerated by Microsoft's decision to end text and phone MFA. Backups should be tested rather than assumed, because a backup that has never been restored is a hope rather than a control. Access should also be reviewed whenever an officer leaves a position, since former officers retaining credentials long after their terms end is among the most common quiet vulnerabilities we encounter during assessments.
None of these measures is exotic, and none requires the budget of an international affiliate. What they require is a decision by leadership that the duty of care owed to members extends to the digital records describing their lives. A union's bargaining power has always rested on trust, and that trust is not easily rebuilt once forty thousand members receive a letter explaining that their Social Security numbers were exposed. In my view, the TWU Local 100 incident should be read less as one local's misfortune and more as a preview of what awaits any organization that holds deeply personal data while treating its network as an afterthought.
