ComplaintsforRehabilitation Support Services

• Initial Complaint

  10/04/2021

  Complaint Type:

  Service or Repair Issues

  Status:

  Answered

  More info

  On June 1, 2021 RSS experienced a cyber breach that resulted in my personal information showing up on the dark web. They sent me a letter with instructions on how to enroll with *******. The link they provided wasn’t correct. I phoned ******* help line. The woman that assisted me, although kind, was based in India and asked me to send copies of my Soc. Security card, non-drivers I’d, a bank statement, a utility bill and a letter or my birth certificate. Needless to say I feel exceedingly uncomfortable sending all this information. I phoned RSS to get further assistance as I feel the burden of responsibility falls to them. They have a responsibility to protect personal information therefore they should enroll me. I phoned them for additional assistance and was told there was nothing they could do. Now I am receiving crazy texts and emails stating that my packages are ready for pick up, I won Monet etc. I am formally requesting financial compensation for stress caused by this incident.

  Business response

  11/18/2021

  We are in receipt of Complaint #******** pertaining to a data security incident experienced by Rehabilitation Support Services (“RSS”). We responded preliminarily upon discovering your letter on October 27, 2021. On June 1, 2021, RSS detected suspicious activity within its network that temporarily disrupted access to certain files and RSS computers. RSS immediately launched an investigation and engaged cybersecurity experts to assist in its response to the incident. Furthermore, RSS reported the incident to law enforcement, including the Federal Bureau of Investigation (“FBI”), and is cooperating with the FBI in hopes of holding the perpetrator(s) accountable. On June 11 and 25, 2021, RSS found certain of its files were taken by unauthorized actors in the course of the incident and published on a dark web website. RSS notified all potentially affected individuals via first class U.S. mail and provided complimentary credit monitoring and identity protection services through ******* to those individuals. These services include 12 months of credit monitoring, dark web monitoring, up to $1,000,000 in identity theft insurance, and identity theft restoration services. RSS also notified relevant state regulatory authorities of the incident. RSS takes the protection of all information within its possession very seriously and has taken significant steps to help prevent a similar incident from occurring in the future, including working with leading cybersecurity experts to enhance the security of its network environment. Unfortunately, Ms. *****’s information was impacted by this incident and she was thus notified by letter. We regret any worry or inconvenience this has cause Ms. ***** and are committed to assisting all impacted individuals with obtaining the complimentary services which RSS has voluntarily offered to impacted individuals. The Complaint alleges that the link to enroll in the complimentary credit monitoring services provided in the notification letter received by Ms. ***** was incorrect. Attached is the notification letter that was mailed to Ms. *****, which contains the link ************************. This hyperlink is correct and active, and 272 individuals have thus far successfully enrolled in credit monitoring services online. The Complaint also states that Ms. ***** phoned the ******* help line for assistance, and that the woman who assisted her was based in India and asked for copies of her Social Security card, non-drivers identification, bank statement, a utility bill, and a letter or her birth certificate. Ms. ***** is able to enroll in services online or over the phone without providing this documentation. However, it is our understanding that Ms. ***** requested assistance making a change to her credit file. When a change to a credit file is requested, an enrollee must go through an authentication process, and a series of verification documents including those requested are required. In the event that Ms. ***** prefers not to enroll in ******* services and/or provide the documentation requested, there are several other steps that Ms. ***** can take to protect her information provided in her letter. RSS remains dedicated to helping Ms. ***** and resolving these issues. Additionally, RSS provided a specific toll-free number in the notification letter for use by notification letter recipients if they have any questions, concerns, or need assistance. RSS’s trained call center representatives are well-versed in this incident and would be happy to assist Ms. ***** with the enrollment process and/or any other questions. Our records indicate that Ms. ***** never contacted this resource provided. The Complaint states that Ms. ***** phoned RSS to get further assistance but was told there was nothing RSS could do. We have been unable to determine to whom Ms. ***** spoke and regret the frustration this caused her. However, all RSS employees are not well-versed in the incident and the remediation services available, as may RSS employees are focused on providing the important services RSS provides to its clients on a daily basis. The toll-free number provided in the notification letter is designed to handle any calls, questions or issues that arise related to this matter and the representatives are able to address concerns precisely like the ones Ms. ***** has articulated. If the representative is unable to address all of Ms. *****’s concerns, she will be referred for additional assistance within RSS and connected to someone who can. Should Ms. ***** want additional assistance, we continue to be happy to help and to connect Ms. ***** to a knowledgeable person. The Complaint also states that Ms. ***** is receiving “crazy texts and emails stating that my packages are ready for pick up, I won Monet etc” and that she is formally requesting financial compensation for stress caused by the incident. Ms. ***** has requested $200, for RSS to enroll her in ******* credit monitoring, and for her information to be removed from RSS’ database. RSS believes any strange emails or text messages received by Ms. ***** are very unlikely to be related to this incident. Based on the opinions of independent cybersecurity experts, the incident was intended to extort RSS for large sums of money as part of an encryption attack, not to obtain and use personal information. Ms. ***** has also not provided any evidence of financial harm as a result of this incident. The complimentary credit monitoring services include credit monitoring, dark web monitoring, up to $1,000,000 in identity theft insurance, and identity theft restoration services in the event of any fraudulent activity. RSS cannot enroll Ms. ***** in the credit monitoring without her involvement for privacy and security reasons, but we would be happy to work with Ms. ***** to get her enrolled in the complimentary credit monitoring and identity theft protection services. RSS will also remove all of Ms. *****’ data that is not required to be maintained for a certain period of time by applicable laws and regulations from its database. Please note that the initial complaint was mailed to *** ******* ***., Albany, NY 12206, and RSS’s office address is 314 Central Ave., Albany, NY 12206. If you have any questions or need additional information, please do not hesitate to contact me at ###-###-#### or at ******************   

*Some consumers may elect to not publish the details of their complaints, some complaints may not meet BBB's standards for publication, or BBB may display a portion of complaints when a high volume is received for a particular business. ↩