Dental Center of Northwest Ohio (the “Dental Center”) recently learned of an incident that may affect the privacy of some personal information. While there is currently no evidence that personal information has been misused, we are making potentially affected individuals aware of the event, the steps we are taking in response, and steps individuals may take to better protect against possible misuse of personal information.
Frequently Asked Questions
Q. What happened?
On or about September 1, 2018, the Dental Center’s IT vendor, Arakyta, made the Dental Center aware of an issue, at Arakyta, potentially impacting certain Dental Center systems. Arakyta later confirmed ransomware had infected Arakyta systems resulting in a disruption to systems storing Dental Center information. The Dental Center immediately launched an investigation into the nature and scope of incident, including working with third-party computer experts to determine what, if any, Dental Center information was impacted by the Arakyta event. Based on the information provided by Arakyta, on November 7, 2018, the Dental Center confirmed that systems containing Dental Center information were potentially accessible to an unknown actor. Although the Dental Center has not received reports of actual access to Dental Center information as a result of the Arakyta event because the Dental Center was unable to rule out the possibility of such access, the Dental Center is notifying individuals whose information was stored on systems potentially impacted by the Arakyta event.
Q. What information was involved?
The investigation in this matter confirmed that the following types of personal information were stored in systems disrupted by the Arakyta event: name, address, date of birth, Social Security number, state identification number, driver’s license number, medical treatment and history, diagnosis and clinical treatment information, medical record and patient number, health insurance and benefit information, and financial account information.
Individuals potentially impacted by this event include Dental Center patients and employees. The types of information involved varies for each patient and employee. We are mailing notice letters to potentially impacted individuals and that letter will list the types of information relating to the individual that may have been impacted. Individuals may also contact our dedicated call center at 1-866-434-7707, Monday through Friday 9:00 a.m. to 6:30 p.m. Eastern Time, to confirm if they are potentially impacted by this event and if so, the types of information that were stored in the systems that were disrupted by the event.
Q. What is the Dental Center doing to respond?
The Dental Center takes the confidentiality, privacy, and security of information in our care very seriously. Upon learning of the Arakyta event, we immediately commenced an investigation to confirm the nature and scope of the event as it relates to the Dental Center and our data. We took steps to identify the personal information stored on systems disrupted by the Arakyta event and are notifying potentially impacted Dental Center patients and employees. We are also providing access to credit monitoring and identity theft restoration services to potentially impacted Dental Center patients and employees, at no cost to these individuals.
While the Dental Center has security measures in place to protect information in our care, we are taking steps to implement additional safeguards and review policies and procedures relating to data privacy and security. We are also notifying relevant regulators of the Arakyta event.
Q. What can I do to protect my information?
Potentially impacted individuals may enroll in the credit monitoring and identity theft protections services that are being offered by the Dental Center. In addition to enrolling in these services, we encourage potentially impacted individuals to remain vigilant against incidents of identity theft and fraud, to review account statements and to monitor credit reports for suspicious activity and to detect errors. Under U.S. law, adults are entitled to one free credit report annually from each of the three major credit reporting bureaus. To order your free credit report, visit annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of your credit report.
Individuals have the right to place a “security freeze” on their credit report(s), which will prohibit a consumer reporting agency from releasing information in the credit report without the individual’s express authorization. The security freeze is designed to prevent credit, loans, and services from being approved in an individual’s name without consent. However, using a security freeze to take control over who gets access to the personal and financial information in a credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application made regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, the credit reporting agencies may not charge to place or lift a security freeze on a credit report. Should you wish to place a security freeze, please contact the major consumer reporting agencies listed below:
P.O. Box 9554
Allen TX 75013
P.O. Box 2000
Chester, PA 19016
P.O. Box 105788
Atlanta, GA 30348-5788
In order to request a security freeze, you will need to provide the following information:
- Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
- Social Security number;
- Date of birth;
- If you have moved in the past five (5) years, provide the addresses where you have lived over the prior five years;
- Proof of current address, such as a current utility bill or telephone bill;
- A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.);
- If you are a victim of identity theft, include a copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft.
As an alternative to a security freeze, individuals have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any one of the agencies listed below:
P.O. Box 2002
Allen, TX 75013
P.O. Box 2000
Chester, PA 19106
P.O. Box 105069
Atlanta, GA 30348
You can further educate yourself regarding identity theft, fraud alerts, security freezes, and the steps individuals can take to protect themselves by contacting the consumer reporting agencies, the Federal Trade Commission, or your state Attorney General.
The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580, identitytheft.gov, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. You have the right to file a police report if you ever experience identity theft or fraud. Please note that in order to file a report with law enforcement for identity theft, you will likely need to provide some proof that you have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement. This notice has not been delayed by law enforcement.
For Maryland residents, the Attorney General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202, 1-888-743-0023, oag.state.md.us.
For Massachusetts residents, Under Massachusetts law, you have the right to obtain any police report filed in regard to this incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it. You can also obtain further information on how to file such a complaint by way of the contact information listed above. Instances of known or suspected identity theft should also be reported to law enforcement, the FTC, and the Massachusetts Attorney General. We understand that you may have questions about this incident that are not addressed in this letter. If you have additional questions, please call our dedicated assistance line at 1-866-434-7707, Monday through Friday 9:00 a.m. to 6:30 p.m., Eastern Time. You may also write to the Dental Center at 2138 Madison Avenue, Toledo, OH 43604.
For New Mexico residents, you have rights pursuant to the Fair Credit Reporting Act, such as the right to be told if information in your credit file has been used against you, the right to know what is in your credit file, the right to ask for your credit score, and the right to dispute incomplete or inaccurate information. Further, pursuant to the Fair Credit Reporting Act, the consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information; consumer reporting agencies may not report outdated negative information; access to your file is limited; you must give your consent for credit reports to be provided to employers; you may limit “prescreened” offers of credit and insurance you get based on information in your credit report; and you may seek damages from violator. You may have additional rights under the Fair Credit Reporting Act not summarized here. Identity theft victims and active duty military personnel have specific additional rights pursuant to the Fair Credit Reporting Act. We encourage you to review your rights pursuant to the Fair Credit Reporting Act by visiting consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf, or by writing Consumer Response Center, Room 130-A, Federal Trade Commission, 600 Pennsylvania Ave. N.W., Washington, D.C. 20580.
For North Carolina residents, the Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-877-566-7226 or 1-919-716-6400, ncdoj.gov.
For Rhode Island residents, the Attorney General can be contacted by mail at 150 South Main Street, Providence, RI 02903; by phone at (401) 274-4400; and online at riag.ri.gov. A total of four (4) Rhode Island residents were impacted by this incident.
Q. Where can I go for more information?
For questions regarding this event potentially impacted individuals may call the Dental Center’s dedicated call center at 1-866-434-7707, Monday through Friday 9:00 a.m. to 6:30 p.m., Eastern Time.