INDIANAPOLIS — Letters from the Indiana Department of Health have gone out to notify nearly 750,000 Hoosiers that data from the state’s COVID-19 online contact tracing survey was improperly accessed and how they can take measures to prevent identity theft from them.
“We sincerely apologize for this incident and regret any inconvenience it may cause you,” the letter says.
The letters sent to affected Hoosiers says the state will provide one year of free credit monitoring and is partnering with Experian to open a call center to answer questions from those impacted. In addition, the Indiana Office of Technology will continue its regular scans to ensure information was not transferred to another party.
The program with Experian will also provide up to $1 million in identity theft insurance, the letter says, that may arise from unauthorized electronic fund transfers. For extreme cases, the program offers identity restoration.
The data hacked from the state included name, address, email, gender, ethnicity and race and date of birth.
“We believe the risk to Hoosiers whose information was accessed is low. We do not collect Social Security information as a part of our contact tracing program, and no medical information was obtained,” said State Health Commissioner Dr. Kris Box in a Aug. 17 news release. “We will provide appropriate protections for anyone impacted.”
The state was notified of the unauthorized access on July 2. The state and the company that accessed the data signed a “certificate of destruction” to confirm that the data was not released to any other entity and was destroyed by the company.
When the state was notified of the unauthorized access, the Indiana Office of Technology and IDOH immediately corrected a software configuration issue and requested the records that had been accessed. The records were returned Aug. 4.
“We take the security and integrity of our data very seriously,” said Tracy Barnes, chief information officer for the state. “The company that accessed the data is one that intentionally looks for software vulnerabilities, then reaches out to seek business. We have corrected the software configuration and will aggressively follow up to ensure no records were transferred.”