Division of Fire PHI Notification
Notification to Impacted Individuals
February 10, 2025
RE: Notice of Cyber Security Incident. Please read this entire letter.
As you may be aware, the City of Columbus was the target of a criminal cyberattack. As part of the City’s ongoing investigation, we have recently learned that some of your information was involved. We are writing to explain our current understanding of what happened, what we are doing, and to provide you with some steps you can take to protect your personal information.
What happened?
Last summer, the City of Columbus learned it was the victim of a cybersecurity attack in which a foreign cyber criminal attempted to disrupt the City of Columbus’s IT infrastructure and, in the process, took data belonging to the City of Columbus Department of Public Safety, Division of Fire (“Division of Fire”). On December 12, 2024, we discovered that a compromised Department of Fire database contained a limited amount of data that could be considered protected health information. We have learned that your information was in that database.
What information was involved?
The database involved was from the Division of Fire and contained dispatch and other records. A small number of these records include brief notes of emergency medical services (EMS) services provided at the location of the EMS call. The information in these notes was not the same for everyone. The data may include a combination of your first and last name, address, date of birth, Social Security number, the date you interacted with the Department of Fire, and brief notes on the EMS service provided. It is important to know there is no evidence that the cyber criminals accessed the Division of Fire’s encrypted electronic medical record system (EMR) that separately holds its treatment records. Additionally, the Division of Fire is presently unaware of any actual or attempted misuse of your data for identity theft or fraud and we have no evidence that financial account information was involved.
What are we doing?
Upon learning of the cyber attack, the City of Columbus immediately launched an investigation and is working with law enforcement in its criminal investigation of the attack. Those investigations are ongoing. The City also took measures to stop the cyber attack, including taking its network offline and implementing additional security measures to make its computer systems even stronger than before. The Division of Fire will also continue to evaluate additional steps that may be taken.
What you can do.
The City of Columbus is offering free identity theft protection services to Columbus residents and individuals who may have shared personal information with the City of Columbus that was subject to compromise in the cyberattack. If you have not already signed up for this service, please enroll in free identity theft protection services. We will pay for the cost of this service for 2 years so that it is free for you.
At this time, there is no evidence that your personal information has been misused, but we wanted to make you aware and provide you with additional information on steps you may consider taking. For more information on Experian IdentityWorks, including instructions on how to activate your free two-year membership, as well as additional steps you may take to help protect your information, please see the additional information provided in the following pages. The deadline to enroll is May 30, 2025.
What if I have a question?
We regret and apologize for any inconvenience or concern this may cause you. If you have further questions or concerns, or would like an alternative to enrolling online, please call 1(833) 918-5161 toll-free Monday through Friday from 9 am – 9 pm Eastern (excluding major U.S. holidays). Be prepared to provide your engagement number B139613. To learn more about this incident, you can also visit the City of Columbus’s website at https://www.columbus.gov/Services/Cybersecurity.
Sincerely,
Jeffrey M. Happ
Columbus Fire Chief
Columbus Division of Fire
3639 Parsons Ave
Columbus, Ohio 43207
REFERENCE GUIDE
Review Your Account Statements
Be on the alert for suspicious activity related to your accounts and credit reports. We encourage you to regularly monitor your statements and records to ensure there are no transactions or other activities that you did not initiate or authorize. You should report any suspicious activity to the appropriate service provider. If you observe unusual activity on any debit/credit card, or you believe your personal bank account shows signs of compromise, we advise you to close out those accounts and request new cards and account credentials.
Order Your Free Credit Report
Additionally, under the Fair Credit Reporting Act, you have the right to know what is in your file and receive notification if information in your file has been used against you in applying for credit or other transactions. In addition, all consumers are entitled to one free disclosure every 12 months upon request from each nationwide credit bureau and from nationwide specialty consumer reporting agencies. You can visit the following website: www.consumerfinance.gov/learnmore for additional information. To order a free credit report, visit www.annualcreditreport.com or call toll free at (877) 322-8228, or complete the Annual Credit Report Request Form on the U.S. Federal Trade Commission’s website at www.ftc.gov and mail it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348- 5281.
When you receive your credit report, please review it carefully. If you see anything you do not understand or recognize, call the credit bureau at the telephone number on the report. Notify credit bureaus of any inaccurate information promptly so that it can be investigated and corrected.
If you are a resident of the State of Massachusetts or the State of Rhode Island, please be aware that under your state’s law, you have the right to obtain any police report filed in regard to this incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.
Contact the U.S. Federal Trade Commission
Additionally, you can report incidents of suspected identity theft to your local law enforcement, the Federal Trade Commission (the “FTC”), and your state attorney general. To file a complaint with the FTC, go to IdentityTheft.gov or call 1-877-ID-THEFT (1 (877) 438-4338). Complaints filed with the FTC will be added to the FTC’s Identity Theft Data Clearinghouse, which is a database made available to law enforcement agencies. Information on how to contact your state attorney general can be found in Appendix A to this letter.
Please take advantage of additional free resources on identity theft. We recommend that you review the tips provided by the FTC’s Consumer Information website, a valuable resource with helpful tips on how to protect your information. Additional information is available at https://www.consumer.ftc.gov/topics/privacyidentity-online-security. A copy of Identity Theft – A Recovery Plan, a comprehensive guide from the FTC to help you guard against and deal with identity theft, is on the FTC’s website at https://www.consumer.ftc.gov/articles/pdf-0009_identitytheft_a_ recovery_plan.pdf.
Place a Security Freeze
Any consumer may place a free security freeze on his or her credit report by: (i) requesting one in writing by certified mail to the consumer reporting agency, (ii) calling the agency directly, or (iii) submitting a form online directly to the agency. A security freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report without written authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit, mortgages, employment, housing or other services. We recommend that you work collaboratively with potential lenders, employers and service providers to ensure that you are protecting both your information and the approval status of your applicable request.
In order to place a security freeze on your credit reports, you must contact each of the three major consumer reporting agencies: Equifax (www.equifax.com); Experian (www.experian.com); and TransUnion (www.transunion.com), at the addresses below:
Equifax Security Freeze
P.O. Box 105788
Atlanta, GA 30348
(888) 298-0045
https://www.equifax.com/personal/credit-report-services/credit-freeze/
Experian Security Freeze
P.O. Box 9554
Allen, TX 75013
(888) 397-3742
https://www.experian.com/freeze/center.html
Trans Union Security Freeze
Fraud Victim Assistance Department
P.O. Box 2000
Chester, PA 19022-2000
(888) 909-8872
https://www.transunion.com/credit-freeze
The credit reporting agencies have a certain number of days after receiving your request to place a security freeze on your credit report, so we recommend placing the freeze as soon as you possibly can. The credit bureaus must also send written confirmation to you, and may provide you with a unique personal identification number (PIN) or password, or both, that can be used by you to authorize the removal or lifting of the security freeze.
Lifting or Suspending a Security Freeze
To temporarily lift or suspend the security freeze, you must call, make a request online, or send a request via electronic media to the credit reporting agencies and include proper identification (name, address, and social security number) and the PIN number (if provided) or password provided to you when you placed the security freeze. Please note, your state may not allow this action to be completed. You should always check your state’s laws on credit freezing before placing a freeze on your credit report.
Removing a Security Freeze
To remove the security freeze, you can either submit the request online, or send a written request to each of the three credit bureaus by mail, secure electronic method, or via their online form, and include proper identification (name, address, and social security number) and the PIN number (if provided) or password provided to you when you placed the security freeze.
How to Enroll in Experian IdentityWorks
Although we do not have any evidence that your personal information has been misused for identity theft or fraud, out of an abundance of caution, the City of Columbus is providing Experian IdentityWorks credit monitoring services for 24 months at no cost to you.
If you believe there was fraudulent use of your information as a result of this Incident, and would like to discuss how you may be able to resolve those issues, please reach out to an Experian agent. If, after discussing your situation with an agent, it is determined that identity restoration support is needed then an Experian Identity Restoration agent is available to work with you to investigate and resolve each incident of fraud that occurred from the date of the Incident (including, as appropriate, helping you withcontacting credit grantors to dispute charges and close accounts; assisting you in placing a freeze on your credit file with the three major credit bureaus; and assisting you with contacting government agencies to help restore your identity to its proper condition).
Please note that Identity Restoration is available to you for 24 months from the date of this letter and does not require any action on your part at this time. The Terms and Conditions for this offer are located at www.ExperianIDWorks.com/restoration.
While identity restoration assistance is immediately available to you, we also encourage you to activate the fraud detection tools available through Experian IdentityWorks as a complimentary 24-month membership. This product provides you with superior identity detection and resolution of identity theft. To start monitoring your personal information, please follow the steps below:
- Ensure that you enroll by May 30, 2025 (Your code will not work after this date.)
- Visit the Experian IdentityWorks website to enroll: https://www.experianidworks.com/3bplus
- Provide your engagement number: B13961
If you have questions about the product, need assistance with Identity Restoration that arose as a result of this Incident or would like an alternative to enrolling in Experian IdentityWorks online, please contact Experian’s customer care team at 1(833) 918-5161 by May 30, 2025. Be prepared to provide engagement number B139613 as proof of eligibility for the Identity Restoration services by Experian.
ADDITIONAL DETAILS REGARDING YOUR 24-MONTH EXPERIAN IDENTITYWORKS MEMBERSHIP
A credit card is not required for enrollment in Experian IdentityWorks. You can contact Experian immediately regarding any fraud issues, and have access to the following features once you enroll in Experian IdentityWorks:
- Experian credit report at signup: See what information is associated with your credit file. Daily credit reports are available for online members only.*
- Credit Monitoring: Actively monitors Experian, Equifax and Transunion files for indicators of fraud.
- Internet Surveillance: Technology searches the web, chat rooms & bulletin boards 24/7 to identify trading or selling of your personal information on the Dark Web.
- Identity Restoration: Identity Restoration specialists are immediately available to help you address credit and non-credit related fraud.
- Experian IdentityWorks ExtendCARETM: You receive the same high-level of Identity Restoration support even after your Experian IdentityWorks membership has expired.
- $1 Million Identity Theft Insurance**: Provides coverage for certain costs and unauthorized electronic fund transfers.
* Offline members will be eligible to call for additional reports quarterly after enrolling.
** The Identity Theft Insurance is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions.