The Indiana Department of Health will notify nearly 750,000 Hoosiers that data from the state’s COVID-19 online contact tracing survey was improperly accessed.
In a statement, State Health Commissioner Dr. Kris Box said the risks to those affected are low because IDOH does not collect Social Security information as part of contact tracing.
State officials said the company that accessed the data looks for software vulnerabilities and then reaches out to drum up business. They said the software issue has been corrected, and the company told the state the data was not released to any other entity and was destroyed.
Apu Kapadia is a professor in IU’s Department of Computer Science. He said this part of the state’s release concerns him.
"The release also talks about data being returned," Kapadia said. "What does it mean to return data? You already have the data. They could have just deleted it."
The data breach included name, address, email, date of birth and demographic information collected during contact tracing. Kapadia says with that information, a social security number isn’t always necessary to access someone’s online accounts.
"You don’t always have to have the social security number if you have so much personal information,"Kapadia said. "You can sometimes reconstruct the social security numbers.”
The state will send letters to those affected by the breach and provide one year of free credit monitoring.
Kapadia said breaches to large businesses or other organizations are not uncommon, and says it’s part of taking part in digital commerce.
He added this is why people should be vigilant and check their bank statements and watch their emails and physical mail carefully.
