The personal information included names, addresses, email, gender, ethnicity and race, and birth dates but no medical or Social Security information, state health officials said.
The state has known about the unauthorized access since July 2 and took immediate steps to correct the issue, correcting the software configuration that had allowed the breach.
However, the company that obtained the data did not return the records until Aug. 4. Last week, the state and the rogue company signed a "certificate of destruction" to confirm that the company had destroyed the data and had not given it to anyone else.
"We take the security and integrity of our data very seriously," said Tracy Barnes, chief information officer for the state in a news release. "The company that accessed the data is one that intentionally looks for software vulnerabilities, then reaches out to seek business. We have corrected the software configuration and will aggressively follow up to ensure no records were transferred."
The state will offer one year of free credit monitoring to anyone affected and will partner with Experian to open a call center to field any questions.
Earlier this month Eskenazi Health announced that it had been struck by a ransomware attack that led the hospital system to suspend temporarily some services. Hospital officials said that no patient or employee data was comprised in that attack.
©2021 www.indystar.com. Distributed by Tribune Content Agency, LLC.
