January 20, 2023 — Cleveland — The City of Cleveland (the “City”) announced today that it is offering two years of credit protection and $1 million in insurance after it recently discovered an incident that may affect the personal information of certain current or former employees of the City. Because the City is committed to transparency and takes the protection and proper use of personal information very seriously, the City is providing information about the incident, steps the City is taking in response, and steps impacted individuals may take to guard against identity theft and fraud, to all those affected.
On December 20, 2022, the City discovered that a Request for Proposal (“RFP”) for healthcare provider services that was prepared by its business associate inadvertently included sensitive participant information in three of its healthcare census data attachments. The RFP was posted to the City’s public-facing procurement website on October 14, 2022, and was removed upon discovery on December 20, 2022.
The information did NOT include any diagnosis, disability, additional personal information, or other additional prescription drug information. Credit card information, banking information, and medical information such as test results or treatment records, were NOT included.
The census files contained in the posted RFP included certain personal information and protected health information (“PHI”) for prescription drug fills and services between April 1, 2020, and March 31, 2022. This data for affected City of Cleveland employees included first name, last name, Social Security number with a 2-digit extension, and number and gross value of his or her prescription drug services. For dependents the information included first name, last name, and number and gross value of his or her prescription drug services.
This event was not the result of a compromise of the City’s cybersecurity. Importantly, the City has no reason to believe any information was actually compromised or misused. However, the City is approaching this with an abundance of caution as privacy is of the utmost importance.
This week, letters are being sent by U.S. Mail notifying potentially impacted individuals. At no cost to them, the following services will be made available through Identity Theft Guard Solutions, Inc. (“IDX”) for 24 months:
- Single Bureau Credit Monitoring;
- CyberScan Dark Web Monitoring;
- $1M Reimbursement Insurance;
- Fully Managed Identity Recovery; and
- Lost Wallet Assistance.
As part of that process, the City is reviewing its policies and processes for RFPs and website postings. The City is also working with its business associate to apply additional protocols and training regarding information privacy practices. More broadly the City will be implementing additional employee training with respect to identifying and managing sensitive information. This matter is also being reported to the U.S. Department of Health and Human Services and any other required agencies.
The City recommends that everyone remain vigilant for incidents of fraud and identity theft, including by reviewing account statements and monitoring free credit reports. Individuals can find information about proactively taking steps to protect themselves, including fraud alerts and security freezes, from the Federal Trade Commission and credit bureaus. Contact information for the FTC and three major credit bureaus is below:
The Federal Trade Commission
600 Pennsylvania Avenue, NW
Washington, DC 20580
1-877-ID-THEFT (1-877-438-4338)
TTY: 1-866-653-4261 www.ftc.gov/idtheft
Equifax® P.O. Box 740241 Atlanta, GA 30374-0241 1-800-685-1111 www.equifax.com
Experian P.O. Box 9701 Allen, TX 75013-9701 1-888-397-3742 www.experian.com
TransUnion® P.O. Box 1000 Chester, PA 19016-1000 1-800-888-4213 www.transunion.com
A dedicated call center and website have been setup for Individuals who believe they may be impacted by this incident.
Affected individuals may call 1-833-896-6832 or go to https://response.idx.us/cityofcleveland for questions or assistance enrolling in the identity protection program.
