You might have recently opened a letter informing you about a data breach of the Jefferson County Health Department’s records and wondered whether it’s on the up-and-up.
It is indeed, Health Department officials said.
They said the agency sent 115,940 letters to clients whose records were in electronic form.
The letter details a security breach of the Health Department’s network, which was discovered on Nov. 15, 2022. Suspicious activity was detected, the letter said, that included ransomware, a form of malware, or malicious software, that threatens to lock a user out of a computer system unless some sort of payment is agreed upon.
The letter stated that Health Department employees immediately began a successful effort to restore its system.
The department then employed a forensic investigation firm to determine what information, if any, was compromised.
That firm concluded that the Health Department’s system had first been accessed between Oct. 31, 2022, and Nov. 15, 2022, and that while it could not find conclusive evidence, “a limited amount of files may have been accessed.”
The letter directs recipients to sign up for a free year of credit monitoring through the Equifax consumer credit reporting agency and up to $1 million in identity theft insurance.
Those who want to register with Equifax must do so online by April 30.
Brianne Zwiener, public communications officer for the Health Department, said to expedite the process of informing the department’s clients about the breach, it hired a mail processing vendor to send out the letters.
“The return address on the envelope is for the mail processing vendor based in Oregon,” she said.
Zwiener and Dennis Diehl, chairman of the Health Department Board of Trustees, said they were advised by the agency’s insurance company counsel against disclosing how much the data breach has cost the department, including how much it cost for the Equifax services, the cost of hiring the forensic firm and the cost to mail out those letters.
However, Diehl said the department “does have insurance for this kind of situation,” which means the only out-of-pocket cost will be for its deductible.
Diehl said he could not say how much the deductible is.
Christy Coleman, the Health Department’s attorney, said the department is being advised in issues arising from the data breach by the insurance company.
Zwiener said the Health Department sent out the letters about the breach, which were mailed in mid-January, as soon as it could.
“Upon identifying the scope of the data security incident, and in continuing its thorough investigation, JCHC also undertook a comprehensive and time-consuming manual review process to identify the specific individuals with personal information and/or protected health information contained therein, if any. The forensic investigation and manual review process were completed on Nov. 30, 2022. We notified individuals as soon as we could once we determined that the data security incidents may have impacted individual’s personal information and/or protected health information.”
Zwiener also said those who received letters didn’t necessarily have information compromised.
“Please note that it is entirely possible that the individual’s personal information and/or protected health information may not have been compromised as a result of the incident,” she said.
Those with questions about the breach are directed to call 1-888-231-1048 from 8 a.m. to 8 p.m. on weekdays.