CLEARFIELD – Some local children may have had their personal information exposed in a recent data security breach, according to the County Commissioners Association of Pennsylvania.
The breach involved a third-party vendor and affected approximately 1,800 child welfare cases statewide. GANT News partner WJAC-TV has reported 69 cases were affected in Clearfield County.
In May, a Pennsylvania-based county children and youth worker found the exposure upon executing their normal work responsibilities, said Ken Kroski, CCAP director of media and public relations.
According to Kroski, information stored in certain counties’ Child Accounting and Profile System databases was publicly viewable online.
“It is important to note first that this was not a cyberattack, not phishing, not hacking; it was a temporary exposure of information,” he said.
The information may have included personally identifiable information (name, address, date of birth, Social Security number, etc.) and protected health information (family treatment information and other family medical information).
Kroski said that the databases are maintained by a third-party vendor, Avanco International, and information and data stored on county-owned systems was not affected.
When the situation became known, the County Commissioners Association of Pennsylvania, on behalf of counties which utilize the information maintained by Avanco, engaged legal counsel with expertise in cyber law.
Their legal counsel then engaged a digital forensics company – to ensure the information was removed from the internet, to conduct an investigation to determine the cause and to put measures in place to help ensure an incident like this does not happen again.
“Based on the investigation, we have no indication that the information was inappropriately used,” Kroski said.
“Due to the serious privacy implications of the situation, communication during the investigation was limited to the county solicitors in each of the affected counties.
“Notice letters were sent to affected individuals on June 30. Counties understand their obligation to ensure that sensitive information about the people they serve is kept secure, and take this incident very seriously.
“They are confident the measures put in place will provide the necessary privacy and security their clients expect in order to ensure our children are given the care and protection they deserve.”
A copy of the county’s notice to affected individuals was provided to GANT News. However, neither the Clearfield County Commissioners nor CYS Administrator Jason Hamilton could be reached for comment.
