Notice of Data Incident

We experienced a data security incident which may have involved personal information. Although we have no information that anyone’s data has been misused, we take the privacy and security of all information within our possession very seriously.

What Happened? We recently learned that personal information of certain individuals was potentially accessed without authorization. The incident in our network was detected on August 9, 2025 and we promptly initiated an investigation of the matter and engaged cybersecurity specialists to assist with the incident response. We later learned that certain files may have been accessed without authorization.  We reviewed which data may have been involved and learned that personal information was contained in some files. Again, we have no evidence of the misuse, or attempted misuse, of any potentially involved information.

What Information was Involved? For some people the information involved may have included name and Social Security number. For others the information may have included name, Social Security and/or medical information.

What Are We Doing? As soon as we discovered this incident, we took the steps described above and examined our system to minimize the risk of a similar incident occurring in the future. As an additional measure, for some individuals who had particular information involved, out of an abundance of caution we are offering complimentary access to identity protection services.

On November 14, 2025 we provided notice, via email, of this incident to individuals for whom we had been provided a valid email address. We have also notified the Federal Bureau of Investigation of the incident and are assisting their investigation.

What You Can Do. You can review the advice below to help protect your information. You can also call 1-833-353-8060 Monday through Friday from 8:00 a.m. to 8:00 p.m. Eastern time, excluding U.S. holidays to request additional information.

For More Information. Further information about how to protect your personal information appears below. If you have questions or need assistance, please call 1-833-353-8060.

 What steps can I take to protect my personal information?

• Please notify your financial institution immediately if you detect any suspicious activity on any of your accounts, including unauthorized transactions or new accounts opened in our name that you do not recognize. You should remain vigilant regarding unauthorized activity and promptly report any fraudulent activity or any suspected incidents of identity theft to proper law enforcement authorities.
• You can request a copy of your credit report, free of charge, directly from each of the three nationwide credit reporting agencies. To do so, free of charge once every 12 months, please visit www.annualcreditreport.com or call toll free at 1-877-322-8228. Contact information for the three nationwide credit reporting agencies is listed at the bottom of this page.
• You can take steps recommended by the Federal Trade Commission to protect yourself from identify theft. The FTC’s website offers helpful information at ftc.gov/idtheft.
• Additional information on what you can do to better protect yourself is included in your notification letter.

How do I obtain a copy of my credit report?

You can obtain a copy of your credit report, free of charge, directly from each of the three nationwide credit reporting agencies.  To order your credit report, free of charge once every 12 months, please visit www.annualcreditreport.com or call toll free at 1-877-322-8228. Use the following contact information for the three nationwide credit reporting agencies:

How do I put a fraud alert on my account?

You may consider placing a fraud alert on your credit report. This fraud alert statement informs creditors to possible fraudulent activity within your report and requests that your creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact Equifax, Experian or IDX and follow the Fraud Victims instructions. To place a fraud alert on your credit accounts, contact your financial institution or credit provider. Contact information for the three nationwide credit reporting agencies is included in the letter and is also listed at the bottom of this page.

How do I put a security freeze on my credit reports?

You also have the right to place a security freeze on your credit report. A security freeze is intended to prevent credit, loans and services from being approved in your name without your consent. To place a security freeze on your credit report, you need to make a request to each consumer reporting agency. You may make that request by certified mail, overnight mail, or regular stamped mail, or online by following the instructions found at the websites listed below. You will need to provide the following information when requesting a security freeze (note that if you are making a request for your spouse, this information must be provided for him/her as well): (1) full name, with middle initial and any suffixes; (2) Social Security number; (3) date of birth; (4) address. You may also be asked to provide other personal information such as your email address, a copy of a government-issued identification card, and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be legible, display your name and current mailing address, and the date of issue. There is no charge to place, lift, or remove a freeze. You may obtain a security freeze by contacting any one or more of the following national consumer reporting agencies:

We take your trust in us and this matter very seriously and regret any concern this may cause.

Sincerely,

Pennsylvania Office of Attorney General
Strawberry Square
Harrisburg, PA 17120