U.S. nonprofit BAMSI says data breach impacted over 20,000 individuals

U.S. nonprofit Brockton Area Multi Services recently disclosed a data security incident that compromised the sensitive personal information of more than 20,000 individuals.

 

Massachusetts-based Brockton Area Multi Services (BAMSI) is a non-profit organisation that provides behavioural health, children, youth, family, day and residential, elderly, and housing services.

 

In a data breach notice filed with the Office of the Maine Attorney General, BAMSI said that April 14, 2023, it  identified unusual activities in its internal systems. BAMSI immediately launched an investigation, with assistance from external cyber security, to determine the nature and scope of the incident.

 

“This forensic investigation determined that certain BAMSI data may have been accessed or acquired without authorisation in connection with this incident. As a result, BAMSI launched a comprehensive review of the potentially affected data, then worked diligently to validate the results and confirm addresses for potentially affected individuals in preparation for notification.

 

“These efforts concluded on April 29, 2024, and identified some personal information within the potentially affected dataset,” it said.

 

The compromised data included names, dates of birth, Social Security numbers, driver’s license or state identification card numbers, account numbers, diagnosis or treatment information, and health insurance information. BAMSI’s filing with the state regulator also revealed that at least 23,705 individuals were impacted by the data security incident.

 

“As soon as we discovered the incident, we took the steps described above. We have also implemented additional security measures to protect our digital environment and minimise the likelihood of future incidents,” BAMSI added.

 

While the company found no evidence of the compromised information being misused, it has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through IDX to all affected individuals.