North Dakotans receiving developmental disability services affected by phishing attack on state

A data breach made public Monday by the North Dakota Department of Health and Human Services may have exposed health information of people receiving developmental disability services.

A phishing email attack targeted the Department of Health and Human Services in July. The Information Technology Department investigated and determined that three Developmental Disabilities Division employees interacted with the phishing email, which led to unauthorized access of their email accounts, according to the agency. 

The Information Technology Department promptly secured the accounts, but some personal health information may have been accessed. The information exposed may include name, contact information, date of birth, age, developmental disabilities service information, name of health plan and identification number, medical information and guardian information.

The department said it is providing written notification to those affected by the breach and encourages them to monitor their medical and financial accounts for potential fraud.

“HHS takes the privacy and security of protected health information seriously,” the Health and Human Services Department said in a statement. “We are working closely with NDIT to strengthen safeguards, enhance cybersecurity awareness training, and prevent similar incidents.”  

Those affected by the breach should be cautious of unexpected communications through email, text messages, phone calls, or requests for personal information, the department said.

Free fraud alerts can be placed with the three credit reporting agencies at:

• Equifax: (877) 478-7625 or www.equifax.com
• Experian: (888) 397-3742 or www.experian.com
• TransUnion: (800) 680-7289 or www.transunion.com

Additional information on reporting identity theft can be found on the North Dakota Attorney General’s website or through the Federal Trade Commission website.

The department notified the U.S. Department of Health and Human Services Office for Civil Rights and the North Dakota Attorney General’s Office about the unauthorized access of protected health information.

Those affected by the data breach should contact Kristen Vander Vorst, Developmental Disabilities Field Services Administrator for HHS, at (800) 755-8529.