Ulster County Executive Jen Metzger and County Comptroller March Gallagher are speaking out following a cybersecurity breach involving Alera Group, the vendor responsible for administering employee health benefits for County government employees.
The breach, which occurred in August 2024, was only disclosed to the County and impacted employees within the past few weeks. Alera Group—formerly known as Relph Benefit Advisors—reportedly did not confirm the extent of the breach until April 2025, leaving a nearly eight-month gap in response and notification.
In response, Alera began sending letters last week to affected County employees and is offering 24 months of complimentary credit monitoring through a third-party provider.
County Executive Jen Metzger criticized Alera’s handling of the breach as “inexcusable,” citing the company’s delay in alerting both the County and its workforce.
“Immediate action should have been taken by the Alera Group to enroll employees in credit monitoring at the point of the data breach,” Metzger said in a message to employees. “The Alera Group’s response to this cybersecurity breach falls far short of what we would expect from the administrator of our employees’ healthcare benefits, and must be held to account.”
Metzger said she is considering all options available to the County, including legal action, and will be notifying the New York State Attorney General.
County Comptroller March Gallagher echoed those concerns, highlighting the troubling scope of third-party access to employee data.
“I am extremely concerned that Ulster County employees and their families have experienced a breach of trust because of a cyber-security incident at a third-party vendor,” Gallagher said. “The multiple notifications employees received were wasteful, unnecessary, and concerning.”
Gallagher noted that Alera Group appears to coordinate with other entities not directly contracted with the County, raising broader questions about data privacy and oversight.
“I look forward to working with the County Executive and Legislature to address the issues raised by this data breach and hold the County’s health insurance broker accountable for their actions,” she added.
Ulster County is encouraging affected employees to enroll in the complimentary credit monitoring service, and the Personnel Department is offering support to those who need assistance.
The County says it will continue to provide updates as more information becomes available.
Image Credit: Blogtrepreneur
Data breech from Alera Group I received 3 letters from them on July 30st 2025,stating that My sensitive inf such as social security number, date of birth and more were removed from their network and 10,000 others too. The breech took place from July 18 2024 to August 4 2024. They just notified me a year later.