Frequently Asked Questions about the Data Breach at CMH

1. What happened?
     Community Memorial Healthcare (CMH) was the target of a cybersecurity incident on October 18, 2023. An unauthorized third-party infiltrated our network. Upon detection, we immediately took steps to secure our network, investigate and determine the nature of the incident, as well as enhance our network security measures. A comprehensive investigation was also done to identify any potentially compromised sensitive data.

2. When did CMH find out about the breach?
     The security incident was discovered on October 18, 2023, when CMH became aware of unauthorized activity within their network.

3. I received a letter in the mail. Is this fraudulent, a scam, or a real incident?
     Federal and state laws require that we notify you by mail. We can assure you that this incident did occur and thus we are offering the support identified within the notification letter. We would encourage you to take advantage of the identity monitoring services provided and call us at the number noted within your letter

4. Why didn't you just call me?
     State and Federal laws require written notification. Also, we wanted to be sure you knew this was a legitimate notice and that the affected people received the notice.

5. Why did you wait so long to notify me?
     We understand your concerns. We moved as quickly as we reasonably could. It took a little time to determine what information was compromised and who was affected. Although we realized on Oct. 18 that an incident had taken place, we were not able to determine the extent of the breach until we completed a comprehensive investigation.

6. What kind of data was compromised?
     Although we have no evidence that your information has been misused, it is possible that certain sensitive information could have been exposed to the unauthorized party. Please reference your letter for the types of information potentially at risk.

7. How many people were affected by the data breach?
     We do not have this information, but every individual potentially compromised has received a similar letter.

8. Is my spouse/family member/friend affected? He/she is/was an employee or patient, as well.
     Each impacted person will or should have received their own letter from CMH. Unless he/she has received a letter, he/she is not affected by this incident.

9. Who is Transunion? I thought my information was held by CMH?
     Transunion has been hired by CMH to provide you with services following the incident.

MOVING FORWARD

10. Has the missing data been misused?
     As of this writing, CMH has not received any reports of related identity theft since the date of the incident (Oct. 18, 2023, to present).

11. Is there a law enforcement investigation?
     The FBI has been notified and we have been in communication with them regarding the incident.

12. What is CMH doing to make sure this does not ever happen again?
     We are reviewing all of our current security protocols and adding additional security measures as needed to prevent this from happening again. IT professionals conducted a thorough investigation and provided recommendations for security enhancement.

IDENTITY THEFT CONCERNS

13. I am concerned about identity theft - what can I do?
     There are a variety of steps you can take, many of which were detailed in the letter you received. These include placing a fraud alert with the credit bureaus, reviewing your financial statements, and signing up for credit monitoring.

14. I am not satisfied that you are doing enough to protect me - what else can you do to help? I will be contacting my attorney or filing a lawsuit.
     We understand your concerns entirely. Please give CMH management a call at 785-562-2311 to discuss further.

15. Why do I have to provide you with my social security number?
     Your Social Security number is your unique identifier with the credit bureaus, and Transunion has to have this information in order to provide you with credit monitoring services.

16. Since my address is included with the information, am I in any danger of being robbed?
     Your address is likely available through many other sources of public records and is not generally considered personal information by itself.

17. Whatwill happen if I find out my identity has been stolen?
     In the unlikely event that your information is misused, a personal advocate will work with you from the first call you make to report the problem until the crisis is resolved. Transunion will notify the appropriate agencies, businesses, institutions, and create a comprehensive case file.