SETTINGS

Reset High Contrast Text Only

-A A A+

Notice of Data Incident

Notice of Data Incident

Dallas County, which is a separate and distinct entity from the City of Dallas, is currently investigating and addressing a data-related incident. Importantly, this incident was not the result of a cybercriminal or the result of an external intrusion into the County’s systems. While the investigation remains ongoing, Dallas County is providing notice of the incident, its response, and resources to help individuals protect their personal information.

What Happened?

In early January 2023, the County was notified by an individual who had purchased a County computer at auction that the computer contained a hard drive, the contents of which had not been properly removed prior to being sold. As soon as the County became aware of the incident, it launched its incident response process and initiated an investigation to determine the nature and scope of the incident. While that investigation remains ongoing, the County has initially determined that certain County computers that were auctioned did not have their hard drives removed in accordance with the County’s established policies and procedures. The County is working diligently to recover those computers through an asset recovery process.

What Information Was Involved?

The County believes that computers previously used by the Dallas County Sheriff’s Department and other County departments are involved in this incident. This means it is possible that personally identifying information, criminal records information, and protected health information belonging to certain Dallas County residents or individuals who have interacted with Dallas County may be involved. 

What is Dallas County Doing?

This matter remains under investigation. Nevertheless, the County is committed to sharing additional facts as they become available and to collaborating with relevant regulatory authorities and law enforcement to resolve this incident in a manner that is in the best interests of those it serves. The County has established a dedicated website that can be accessed by visiting www.dallascounty.org and clicking the “Notice of Data Incident” link, where the County will continue to share material updates in its investigation, should additional relevant developments occur. 

As noted above, the County has also begun an asset recovery process to buy back computers that were sold. If individuals believe they may have one of these computers in their possession, the County encourages them to contact 1-888-805-7072 immediately. We appreciate the support of our community in this matter.

Protecting our residents is of utmost importance to us. Although our investigation is not complete, out of an abundance of caution, the County has proactively arranged for IDX, an identity protection company, to provide individuals who believe they have been impacted by this incident with complimentary identity protection services. A description of the benefits and enrollment instructions for the complimentary identity protection services is provided below.   

While this incident was not the result of a cybercriminal or the result of an external intrusion into its systems, the County will, out of an abundance of caution, monitor the dark web (the part of the internet used by cybercriminals) to assist with determining whether any of the information impacted by this incident has been further exposed. 

What Can Individuals Do?

The County encourages individuals to consider the following recommendations to protect their personal information:

  1. Register for Identity Protection Services. We have arranged for IDX to provide you with two years of complimentary identify protection services. These services provide you with access to the following:
  • Single Bureau Credit Monitoring (for adults). Monitoring of credit bureau for changes to your credit file such as new credit inquires, new accounts opened, delinquent payments, improvements in your credit report, bankruptcies, court judgments and tax liens, new addresses, new employers, and other activities.
  • CyberScan. Dark web monitoring of underground websites, chat rooms, and malware to identify trading or selling of personal information.
  • Identity Theft Insurance. Identity theft insurance will reimburse you for expenses associated with restoring your identity should you become a victim of identity theft. If your identity is compromised, the policy provides coverage for up to $1,000,000, with no deductible, from an A.M. Best “A-rated” carrier. Coverage is subject to the terms, limits, and/or exclusions of the policy. 
  • Managed Identity Recovery Service. This service provides restoration for identity theft issues such as: account creation, criminal identity theft, medical identity theft, account takeover, rental application, tax fraud, benefits fraud, and utility creation.

We encourage you to contact IDX with any questions, including questions relating to child identity protection services, and to enroll in the complimentary identity protection services by calling 1-888-805-7072. IDX representatives are available Monday through Friday from 8 am - 8 pm Central Time.

In order for you to receive the complimentary identity protection services described above, you must enroll by June 29, 2023.  

  1. Review Your Accounts for Suspicious Activity. We encourage you to remain vigilant by regularly reviewing your accounts and monitoring credit reports for suspicious activity. 
  2. Order a Credit Report. If you are a U.S. resident, you are entitled under U.S. law to one free credit report annually from each of the three nationwide consumer reporting agencies. To order your free credit report, visit www.annualcreditreport.com or call toll-free at 1-877-322-8228. If you discover information on your credit report arising from a fraudulent transaction, you should request that the credit reporting agency delete that information from your credit report file. Contact information for the nationwide credit reporting agencies is provided in the next section.
  3. Contact the Federal Trade Commission, Law Enforcement and Credit Bureaus. You may contact the Federal Trade Commission (“FTC”), your state’s Attorney General’s office, or law enforcement, to report incidents of identity theft or to learn about steps you can take to protect yourself from identity theft. To learn more, you can go to the FTC’s websites at www.identitytheft.gov and www.ftc.gov/idtheft; call the FTC at (877) IDTHEFT (438-4338); or write to: FTC Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580.

You may contact the nationwide credit reporting agencies at:

Equifax
(800) 525-6285
P.O. Box 740241
Atlanta, GA 30374-0241
www.equifax.com		Experian
(888) 397-3742
P.O. Box 9701
Allen, TX 75013
www.experian.com		TransUnion
(800) 916-8800
Fraud Victim Assistance Division
P.O. Box 2000
Chester, PA 19022
www.transunion.com
  1. Additional Rights Under the FCRA. You have rights pursuant to the Fair Credit Reporting Act, such as the right to be told if information in your credit file has been used against you, the right to know what is in your credit file, the right to ask for your credit score, and the right to dispute incomplete or inaccurate information. Further, pursuant to the Fair Credit Reporting Act, the consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information; consumer reporting agencies may not report outdated negative information; access to your file is limited; you must give your consent for credit reports to be provided to employers; you may limit “prescreened” offers of credit and insurance you get based on information in your credit report; and you may seek damages from violators. You may have additional rights under the Fair Credit Reporting Act not summarized here.

Identity theft victims and active-duty military personnel have specific additional rights pursuant to the Fair Credit Reporting Act. We encourage you to review your rights pursuant to the Fair Credit Reporting Act by: (i) visiting https://files.consumerfinance.gov/f/documents/bcfp_consumer-rights-summary_2018-09.pdf; or (ii) by writing to Consumer Financial Protection Bureau, 1700 G Street, N.W., Washington, DC 20552. 

  1. Request Fraud Alerts and Security Freezes. You may obtain additional information from the FTC and the credit reporting agencies about fraud alerts and security freezes. You can add a fraud alert to your credit report file to help protect your credit information. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to protect you, but it also may delay your ability to obtain credit. You may place a fraud alert in your file by calling just one of the three nationwide credit reporting agencies listed above. As soon as that agency processes your fraud alert, it will notify the other two agencies, which then must also place fraud alerts in your file.

In addition, you can contact the nationwide credit reporting agencies at the following numbers to place a security freeze at no cost to you:

Equifax
(800) 349-9960		Experian
(888) 397-3742		TransUnion
(888) 909-8872

Placing a security freeze prohibits the agency from releasing any information about your credit report without your written authorization. Security freezes must be placed separately at each of the three nationwide credit reporting agencies. When requesting a security freeze, you may need to provide the following information:

  • Your full name, with middle initial as well as Jr., Sr., II, etc.
  • Social Security number
  • Date of birth
  • Current address and all addresses for the past two years
  • Proof of current address, such as a current utility bill or telephone bill
  • Legible copy of a government-issued identification card, such as a state driver’s license, state identification card, or military identification.

After receiving your request, each agency will send you a confirmation letter containing a unique PIN or password that you will need to lift or remove the freeze. You should keep the PIN or password in a safe place. 

For More Information

The County has established a dedicated call center for individuals to call if they have any questions or concerns relating to the incident. The phone number is 1-888-805-7072 and representatives are available Monday through Friday, 8 am - 8 pm Central Time.

The County also encourages individuals to visit its dedicated website, www.dallascounty.org, and click the “Notice of Data Incident” link, where the County will continue to share material updates in its investigation.  

We regret any concern or inconvenience this matter may have caused and appreciate your patience and understanding.