Roughly 2,100 Maine residents receiving benefits from foster care had their names, addresses and Social Security numbers exposed on a public website in September when an employee at a third-party contractor inadvertently posted a confidential file online.
The office mailed letters to affected individuals Nov. 9, about seven weeks after their data was exposed. The incident resulted from a technology system upgrade Sept. 21, when an individual contractor, who has since been terminated, posted information from a Maine Department of Health and Human Services child welfare services database to "a third-party website outside the State of Maine system." The information was publicly accessible for about four and a half hours before it was taken down, agency spokesman David Heidrich confirmed to Becker's Hospital Review.
Mr. Heidrich said the Office of Information Technology waited to notify the affected individuals until it had concluded its internal investigation. The review determined the information had been accessed once during the time it was publicly available.
"After learning that this file had been made publicly available, OIT immediately contacted the third-party website to have the information removed," said Maine Chief Information Officer Jim Smith. "The file in question was removed from the website and any copies of the data in the company's possession deleted."
The office has partnered with AllClear ID to provide credit and identity monitoring services at no cost to the affected individuals.
More articles on cybersecurity:
House seeks information on HHS cybersecurity center efforts
US government warns of North Korean-linked malware attacks
12% of health IT pros increased cybersecurity spending by 50% in 2017, survey finds