Notice of Data Security Incident

Phoenix Programs of Florida (“Phoenix House Florida” or “we”) recently learned that an unauthorized third party accessed certain Phoenix House Florida email accounts at various times between July 13, 2021 and November 1, 2021.  While Phoenix House Florida is not aware any fraudulent activity or misuse of information as a result of the incident, it is posting this Notice to alert you of what happened.

Upon learning of this incident, Phoenix House Florida promptly reset the credentials of the involved email accounts and engaged a leading forensic security firm to investigate the incident. The investigation identified no indication that the unauthorized third party actually viewed or acquired any personal information while accessing the accounts. Nevertheless, as part of the investigation, an intensive search for any personal information in the email accounts that the unauthorized third party could have viewed was undertaken. On September 2, 2022, Phoenix House Florida determined that the accounts contained some individuals’ personal information. The type of information at issue varied for each individual, but may have included the following: name; Social Security number; driver’s license number; date of birth; credit/debit card number, card expiration date, and card CVV/security code; digitized or electronic signature; Client ID; information regarding medical history, condition, treatment, or diagnosis; and health insurance information.

On October 19, 2022, Phoenix House Florida began sending written notification to the individuals whose personal information was contained in the accounts and for whom it has contact information. Individuals should refer to the notice they will receive in the mail regarding steps they can take to protect themselves.  As described in those letters, Phoenix House Florida has arranged for complimentary identity theft protection services for those individuals whose Social Security numbers or driver’s license numbers were involved in the incident. 

As a precautionary measure, involved individuals should remain vigilant to protect against potential fraud and/or identity theft by, among other things, reviewing their account statements, monitoring their credit reports closely, and notifying their financial institutions if unusual activity is detected.  They should also promptly report any fraudulent activity or suspected identity theft to proper law enforcement authorities, including the police and their state’s attorney general.  Affected individuals may also wish to review the tips provided by the Federal Trade Commission (“FTC”) on fraud alerts, security/credit freezes and steps that they can take to avoid identity theft.  For more information and to contact the FTC, please visit www.ftc.gov/idtheft or call 1-877-ID-THEFT (1-877-438-4338).  Affected individuals may also contact the FTC at: Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580.

Contact information for the three national credit reporting agencies is as follows: