August 6, 2020
Ounce of Prevention Fund (the “Ounce”) is posting the following statement to inform individuals of an event that could potentially affect the security of certain information.
What Happened? The Ounce became aware of unusual activity involving certain employee email accounts and immediately began an investigation with the assistance of third-party forensic investigators. Through this investigation the Ounce determined that, as a result of a phishing campaign, certain employee email accounts were accessed without authorization at varying times between August 29, 2019 and November 18, 2019. While the investigation did not determine that specific information within the accounts was viewed by an unauthorized party, the Ounce reviewed the email accounts to identify any personal information that could have been accessible. On April 29, 2020, we determined that some personal information was present in the email accounts at the time of the incident. We reviewed this information and our internal records to identify the individuals associated with this information and their address for purposes of providing notice. Through this process we determined that certain personal information was contained in one or more of the involved email accounts.
What Information Was Involved? Our investigation determined that at the time of the incident the email accounts contained information including name, Social Security number, medical information, health insurance information, financial information, payment card information, driver’s license/state identification numbers, username and password information. The information varied by individual. To date, we are unaware of any actual or attempted misuse of personal information as a result of this incident.
What We Are Doing. The Ounce takes this incident and the security of personal information in its care very seriously. Upon learning of this incident, the Ounce promptly began an investigation using external digital forensic specialists, changed email account credentials, and investigated to confirm the security of its email network. The Ounce is also working with outside digital forensic specialists to enhance its existing security processes and protocols.
Individuals that were determined to be potentially impacted by this event will receive written notice of the event by mail if a valid address existed.
What Can You Do? The Ounce encourages individuals to remain vigilant against incidents of identity theft and fraud and to review account statements for suspicious activity.
Under U.S. law individuals are entitled to one free credit report annually from each of the three major credit reporting bureaus. To order a free credit report, individuals may visit www.AnnualCreditReport.com or call, toll-free, 1-877-322-8228. Individuals may also contact the three major credit bureaus directly to request a free copy of a credit report.
Individuals have the right to place a “security freeze” on a credit report, which will prohibit a consumer reporting agency from releasing information in a credit report without express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in a person’s name without consent. However, be aware that using a security freeze to take control over who gets access to the personal and financial information in a credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application a person makes regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, a person cannot be charged to place or lift a security freeze on a credit report. Should a person wish to place a security freeze, they may contact the major consumer reporting agencies listed below:
P.O. Box 9554
Allen, TX 75013
P.O. Box 160
Woodlyn, PA 19094
P.O. Box 105788
Atlanta, GA 30348-5788
In order to request a security freeze, individuals will need to provide the following information:
- Full name (including middle initial as well as Jr., Sr., II, III, etc.);
- Social Security number;
- Date of birth;
- If a person has moved in the past five (5) years, the addresses they have lived over the prior five years;
- Proof of current address, such as a current utility bill or telephone bill;
- A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.);
- If a person is the victim of identity theft, a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft.
As an alternative to a security freeze, individuals have the right to place an initial or extended “fraud alert” on a file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If an individual is the victim of identity theft, they are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should a person wish to place a fraud alert, they may contact any one of the agencies listed below:
P.O. Box 9554
Allen, TX 75013
P.O. Box 2000
Chester, PA 19016
P.O. Box 105069
Atlanta, GA 30348
Individuals can obtain additional information regarding identity theft, fraud alerts, security freezes, and the steps that can be taken to protect themselves by contacting the consumer reporting agencies, the Federal Trade Commission, or the individual’s relevant state Attorney General.
The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580; www.IdentityTheft.gov; 1-877-ID-THEFT (1-877-438-4338); and TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. Individuals can obtain further information on how to file such a complaint by way of the contact information listed above. Individuals have the right to file a police report if they experience identity theft or fraud. Please note that in order to file a report with law enforcement for identity theft, individuals will likely need to provide some proof that they have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement and the relevant state Attorney General.
For More Information. We understand that you may have questions about this incident that are not addressed in this statement. If you have additional questions or would like to confirm if you are affected by this event, please call our dedicated assistance line at 855-907-2113 between 8:00 am and 8:00 pm Central Time Monday through Friday excluding major U.S. holidays.