EAST VALLEY INSTITUTE OF TECHNOLOGY DATA BREACH

NOTICE: If you received a NOTICE OF DATA BREACH letter from East Valley Institute of Technology, contact the Arnold Law Firm at (916) 777-7777 to discuss your legal options or submit a confidential Case Evaluation.

On August 9, 2024, the East Valley Institute of Technology (“EVIT”) reported a cybersecurity incident (“Data Breach”) to the Office of the Attorney General in Maine. The Data Breach, first detected on January 9, 2024, involved unauthorized access to EVIT’s internal network.

EVIT has initiated the process of sending notifications to the impacted individuals, both via email and mail. These notifications include an offer for a one-year complimentary membership to a credit monitoring service.

To date, it’s reported that approximately 208,717 individuals have been affected, with 48 types of personally identifiable information (“PII”) compromised. Further details of the Data Breach have yet to be disclosed by EVIT. If you have received a breach notification letter from EVIT, it confirms that your data was compromised in this incident.

EVIT is a public career and technical education district serving students primarily from the East Valley region of the Phoenix, Arizona, metro area. EVIT offers a wide range of career training programs designed to equip students with the skills necessary for immediate employment or further education in their chosen fields.

WHAT INFORMATION IS INVOLVED?

The type of compromised information varied among individuals and potentially included:

• Dates of birth
• Social Security numbers
• Driver’s licenses or State IDs
• Places of birth
• Race/ethnicities
• Home phone numbers
• Email addresses
• Home addresses
• Parent/guardian names
• Financial aid account numbers
• Health insurance information (including health insurance policy numbers, subscriber numbers, or policy numbers)
• Medical information
• Health/allergy information
• Diagnosis
• Patient ID numbers
• Institution name
• Treatment information
• Username with password pins or login information
• Patient account numbers
• Biometric data
• Mental or physical diagnosis codes
• Payment card type
• Medical record numbers
• Treatment locations
• Mental or physical condition treatment types
• Prescription information
• Payment card numbers
• Account numbers
• Routing numbers
• Account types
• US alien registration numbers
• Taxpayer identification numbers
• Passport numbers
• Military ID number
• Class lists
• Student ID numbers
• Disciplinary files
• Absence reasons
• Grades
• Course schedules
• Transcripts
• Individualized education plans (IEP) or 504 plans (developed for students with disabilities)
• Class ranks
• Tribal IDs

This information is referred to as your Personally Identifiable Information (“PII”). It provides critical details about you and is integral to your identity. Businesses are legally required to protect this information, or they risk incurring statutory penalties and other legal repercussions. When PII is stolen, it can be used by identity thieves to commit fraudulent activities using your identity.

Specifically, personal medical information (a specific type of PII) is referred to as Protected Health Information (“PHI”). It is protected under both state and federal law. Healthcare providers and other businesses that handle PHI are required to protect that information. Like stolen PII, identity thieves can use stolen PHI to engage in fraudulent activity using your identity. Quite often, hackers use PII and PHI in conjunction.

The best way to protect yourself after a data breach is to immediately sign up for credit and identity protection services.

California offers its residents extra protections and legal rights through the California Consumer Privacy Act (“CCPA”).

NOTICE: If you received a NOTICE OF DATA BREACH letter from EVIT, contact the Arnold Law Firm at (916) 777-7777 to discuss your legal options or submit a confidential Case Evaluation.