04/20/2012
Letters to potential victims of recent Utah Department of Health security breach are out: This morning, I received a letter from the Bureau of managed Health Care, Utah Department of Health, dated April 15. The postmark on the envelope is April 19, no doubt it took a few days to stuff the tens of thousands of letters they're sending out, so if yours hasn't arrived, yet, it may still be coming.
The letter provides some basic information about the breach without any technical details, which is appropriate in this context as that information is available elsewhere. The letter to me also says, "We do not have any evidence that your information has been misused. However, out of an abundance of caution, we are informing you about this incident so that you may properly evaluate what actions you with to take in this matter."
It continues, "To help you detect the possible misuse of your information, we are providing you with a complimentary one year membership of Experian's ProtectMyIDTM Alert. This product helps detect possible misuse of your personal information and provides you with superior identity protection services focused on immediate identification and resolution of identity theft." There are instructions for signing up for Experian's service and an activation code. Activating the service can be done online or via a toll-free phone call. A list of services provided under this product includes:
- A free copy of your Experian Credit Report.
- Daily 3 Bureau Credit Monitoring (will alert you of suspicious activity)
- Identity Theft Resolution - "...a dedicated, U.S.-based Experian Identity Theft Resolution Agent.." will be assigned if your identity is misused
- $1 Million identity Theft Insurance.
This is a good step and the letter goes on to mention that they have and continue to take additional measures to better harden security at the Department of Technology Services, including reviewing every single server under their purview (this will take time).
The last item in the letter mentions the Utah Attorney General's Office's Identity Theft Reporting Information System, which is available at [ ].
The disclosure of this breach was swift, getting this information put together and in the hands of potentially affected citizens has also been done quickly. I applaude our Utah State employees hard work on this issue. These things do happen, and there are no guarantees when it comes to security. A problem was uncovered and thankfully detected in under 3 days from the apparent initial breach.
