July 17, Office of the Attorney General Attn: Security Breach Notification 200 St. Paul Place Baltimore, MD 21202

Transcription

1 July 17, 2014 Office of the Attorney General Attn: Security Breach Notification 200 St. Paul Place Baltimore, MD VIA To Whom It May Concern: Aon Hewitt is a human resources benefits service provider for Bank of America ( B of A ). I write on behalf of my client, Bank of America ( B of A ), to inform you of a recent incident involving the personal information about some of your state s residents. On or about May 19, 2014 we were made aware that a vendor s former employee (Hexaware) saved a copy of certain files and inadvertently uploaded them to an FTP site. This file contained names and social security numbers. Immediate steps were taken to secure the Bank of America employees personal information and remove the site. Approximately 26 individuals affected by this incident are residents of your state. At this time, there is no evidence to suggest that any personal information has been accessed, or has been or will be misused. Nonetheless, out of an abundance of caution, Aon Hewitt is notifying all affected individuals of the incident (via written letter to each) and offering them the opportunity to enroll in 2-years of free credit monitoring. These notifications will begin mailing on or about July 17, A copy of the form of notice to affected individuals in your state is attached for your reference. If you have any questions or need further information regarding this incident, please call me. Best regards, Robyn Sterling Eckerling Privacy Counsel Aon Corporation 200 East Randolph Street, 8N31D Chicago, IL Enclosure

2

3 Name Street Address City, State Zip Date Name We want to make you aware of an incident where a former Aon Hewitt subcontractor inadvertently uploaded Bank of America employee data to their personal internet site. Aon Hewitt is the payroll and benefits administrator for Bank of America. The file contained your name and Social Security number. Once we became aware of the error, the data was removed immediately and is no longer accesible. At this time, we have no evidence that your personal information has been or will be misused. We sincerely apologize for any inconvenience that this incident may cause, and we take privacy very seriously. In response to this situation, we want to offer a free two-year membership to Experian s ProtectMyID TM Alert. This service helps detect identity theft and includes: A free copy of your Experian credit report Daily credit monitoring and alerts of suspicious activity found on your Experian, Equifax and TransUnion credit reports A dedicated Identity Theft Resolution Agent to walk you through the fraud resolution process if suspicious activity occurs A $1 million dollar insurance policy to help cover certain costs including, lost wages, private investigator fees and unauthorized electronic fund transfers How do I enroll in ProtectMyID? Visit the ProtectMyID website at or call to enroll in this service. Use activation code [XXXX] when prompted. You must enroll by October 31, 2014.

4 We re here to help If you have any questions about ProtectMyID, need help reviewing your credit report or suspect that an item on your credit report may be fraudulent, please contact Experian s customer care team at We appreciate your understanding of this matter, and again apologize for any inconvenience. For general questions about this issue, please contact the Global HR Service Center at Representatives are available between 8 a.m. and 8 p.m. Eastern, Monday through Friday. Sincerely, Aon Hewitt

5 U.S. State Notification Requirements For residents of California, Hawaii, Illinois, Iowa, Maryland, Michigan, Missouri, North Carolina, Oregon, Vermont, Virginia, West Virginia, and Wyoming: It is recommended by state law that you remain vigilant for incidents of fraud and identity theft by reviewing credit card account statements and monitoring your credit report for unauthorized activity. You may obtain a copy of your credit report, free of charge, whether or not you suspect any unauthorized activity on your account by contacting any one or more of the national consumer reporting agencies listed below. They can also provide you with information about fraud alerts and security freezes. Equifax P.O. Box Atlanta, GA For residents of Iowa: Experian P.O. Box 2104 Allen, TX TransUnion P.O. Box 6790 Fullerton, CA State law advises you to report any suspected identity theft to law enforcement or to the Attorney General. For residents of Oregon: State laws advise you to report any suspected identity theft to law enforcement, as well as the Federal Trade Commission. For residents of Illinois, Maryland and North Carolina: State laws require us to tell you that you can obtain information from the Federal Trade Commission about steps you can take to avoid identity theft (including how to place a fraud alert or security freeze). If you are a Maryland or North Carolina resident, you may also be able to obtain this information from your state s Attorney General. MD Attorney General s Office Consumer Protection Division 200 St. Paul Place Baltimore, MD NC Attorney General s Office Consumer Protection Division 9001 Mail Service Center Raleigh, NC For residents of Massachusetts and West Virginia: Federal Trade Commission Consumer Response Center 600 Pennsylvania Avenue, NW Washington, DC IDTHEFT ( ) /idtheft/ State laws require us to inform you of your right to obtain a police report if you are a victim of identity theft. You also have the right to place a security freeze on your credit report. A security freeze is intended to prevent credit, loans and services from being approved in your name without your consent; however, using a security freeze may delay your ability to obtain credit. To place a security freeze on your credit report, you need to send a request to a consumer reporting agency by certified mail, overnight mail, or regular stamped mail. The following information must be included when requesting a security freeze (note that if you are requesting a credit report for your spouse, this information must be provided for him/her as well): (1) full name, with middle initial and any suffixes; (2) Social Security number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any applicable incident report or complaint with a law enforcement

6 agency or the Registry of Motor Vehicles. The request must also include a copy of a government-issued identification card and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be legible, display your name and current mailing address, and the date of issue. The consumer reporting agency may charge a fee of up to $5.00 to place a freeze or lift or remove a freeze, unless you are a victim of identity theft or the spouse of a victim of identity theft, and you have submitted a valid police report relating to the identity theft incident to the consumer reporting agency. Equifax Security Freeze P.O. Box Atlanta, GA Experian Security Freeze P.O. Box 9554 Allen, TX TransUnion (FVAD) P.O. Box 6790 Fullerton, CA