The Indiana Department of Health warned Tuesday that over 750,000 people had their personal information improperly accessed last month from the state's COVID-19 contact tracing survey.
The health department said it was notified on July 2 that an unauthorized company gained access to data of Indiana residents that included names, addresses, dates of birth, emails, and information on gender, ethnicity and race.
The department did not disclose the name of the company that accessed the data. But Tracy Barnes, the state's chief information officer, said it was a company "that intentionally looks for software vulnerabilities, then reaches out to seek business," according to a statement given to Newsweek.
State Health Commissioner Kris Box said Tuesday that the risk to Indiana residents affected by the breach of privacy was minimal, as the state does not collect Social Security information for its contact tracing program, and no medical information was obtained.
"We believe the risk to Hoosiers whose information was accessed is low," Box said in a statement. "We will provide appropriate protections for anyone impacted."
The officials added that the company involved signed a "certificate of destruction" last week with the state to confirm that it had destroyed the data and did not release it to another entity. The health department said the records were also returned to the agency on August 4.
The health department and Indiana Office of Technology said they have since corrected a software configuration issue that allowed for the company to access the information in the first place.
"We take the security and integrity of our data very seriously," Barnes said. "We have corrected the software configuration and will aggressively follow up to ensure no records were transferred."
The Indiana Office of Technology said it will also continue regular scans to make sure the data is not transferred to a third party.
The health department said Tuesday that it will now send letters to affected residents notifying them of the privacy breach. The state will also provide one year of free credit monitoring and is working with information services company Experian to launch a call center to answer questions from those affected.
Indiana's contact tracing survey is meant to identify and notify individuals who may have come in contact with COVID-19.
According to data released by the Indiana Department of Health on Tuesday, the state has had a total of 806,094 coronavirus cases and 13,743 deaths since the pandemic began. So far, more than 3 million people – or roughly 45 percent – of the population is fully vaccinated.
Uncommon Knowledge
Newsweek is committed to challenging conventional wisdom and finding connections in the search for common ground.
Newsweek is committed to challenging conventional wisdom and finding connections in the search for common ground.
