Notice of January 2024 Data Breach

What Happened

On January 9, 2024, EVIT was the target of a cyber incident that involved unauthorized access to the network. This attack had a limited impact on our operations.  We immediately took corrective steps to investigate the incident, secure our systems, report the incident to law enforcement, contain and remediate the threat, and notify potentially impacted individuals.  To date, EVIT has not discovered any publication of EVIT data that contained sensitive information.  However, given the possibility that sensitive information may have been compromised, EVIT engaged a third party to conduct a thorough review of all potentially impacted files.  Given the number of potentially impacted files, this review concluded on June 4, 2024.   EVIT then worked with another third party to perform a physical address search, which was completed on August 7, 2024. 

What Information was Involved

For individuals who may have been impacted by the breach, the categories of impacted information may include: Class List, Student ID Number, Date of Birth, Race/Ethnicity, Grades, Course Schedule, Home Phone Number, Email Address, Home Address, Parent/Guardian Name, Transcript, IEP/504 Plan, SSN, Driver’s License or State ID, Financial Aid Information, Class Rank, Place of Birth, TIN, Tribal ID Number, Account Number, Routing Number, Health Insurance Information, Account Type, Disciplinary File, Medical Information, Absence Reason, Financial Aid Account Number, Health/Allergy Information, Diagnosis, Patient ID Number, Institution Name, Health Insurance Policy Number or Subscriber Number or Policy Number, US Alien Registration Number, Medical Record Number, Treatment Location, Payment Card Number, Mental or Physical Condition, Treatment Type, Prescription Information, Passport Number, Treatment Information, Username with Password Pin or Login Information, Patient Account Number, Biometric Data, Mental or Physical Treatment, Diagnosis Code, Payment Card Type, Military ID Number.  The potentially compromised information varies by individual, and for most individuals, not all of this data was potentially compromised.

What are We Doing

We have implemented several measures to ensure that your information is protected from future unauthorized disclosures. EVIT has notified appropriate authorities, as well as provided email notification to all current and former students, staff, faculty, and parents.

Once the contracted third party completed the impacted file investigation and identified potentially impacted individuals by name, EVIT posted a website notice as it simultaneously, diligently worked to send individual notice to anyone identified as potentially impacted by the breach. EVIT worked with another third party to conduct a physical address search. After receiving that address information, EVIT promptly mailed notification letters to physical addresses identified by its notification service vendor. on August 13, 2024. All potentially impacted individuals are eligible to receive credit monitoring and other related services. You can find more information about those services here: https://response.idx.us/EVIT.

Finally, EVIT engaged a third party to help EVIT with adding computer security protections and protocols to harden its network infrastructure and offer improved protections of your sensitive data from unauthorized access.

What You Can Do

To help protect your identity, we recommend that impacted individuals take immediate steps to protect themselves from further potential harm:

• Enroll in the credit monitoring and other related services that EVIT is offering.  You can enroll and find more information here: https://response.idx.us/EVIT.  Sign up for services requires an enrollment code—you’ll find your code on the letter you received in the mail.  If you did not receive a physical letter but did receive notice via email, or otherwise believe your information was involved in this breach, please contact EVIT at evit-notifications@evit.edu to be verified and receive your code if impacted by the incident.
• Closely monitor your financial accounts. If your financial institutions permit you to notify them of a potential theft of your personal information, please do so.
• Place a credit freeze and/or fraud alert on your credit file. A fraud alert is a basic type of alert available to any consumer that tells creditors to contact you before they open any new accounts or change your existing accounts. A credit freeze, also knowns as a security freeze, helps restrict access to your credit report, which then makes it more difficult for other people to fraudulently open new accounts in your name. Call any one of the three major credit bureaus to request a credit freeze and/or fraud alert. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts. But, for a credit freeze, you will need to notify each credit bureau individually. 
  • Equifax  800-685-1111
  • Experian 888-397-3742
  • TransUnionCorp  800-680-7289

Please note there is no cost to place a credit freeze or fraud alert on your credit file, however, the credit bureaus may offer you additional products for a fee. If you elect to set up a credit freeze, you will be required to select a PIN to use when you are ready to un-freeze your credit or submit a legitimate application.  More information about credit freezes and fraud alerts is available from the FTC at https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts

• File an identity theft report with the FTC at IdentityTheft.gov. Details regarding this program are available at: htps://www.ftc.gov/news-events/topics/identity-theft/report-identity-theft.
• Even if you do not find any suspicious activity on your initial credit reports or accounts, the Federal Trade Commission (FTC) recommends checking your credit reports periodically. Reports may be obtained by visiting www.annualcreditreport.com or calling 877-322-8228. Checking your credit reports periodically can help you spot problems and address them quickly. Get a copy of the credit report; many creditors want the information to absolve you of fraudulent charges. Additional information about identity theft is available on the FTC’s website at www.ftc.gov/idtheft.

For More Information

For more information or if you have any questions about this incident, please contact us at evit-notifications@evit.edu  or visit https://response.idx.us/evit/, where frequently asked questions are posted in connection with the free credit monitoring and related services we are offering.