Notice of Data Privacy Incident

Samaritan Daytop Village, Inc. provides notice of a recent incident at one of its third-party vendors, Blackbaud, Inc. (“Blackbaud”), that may affect the security of certain individuals who are current or former patients of one of Samaritan Daytop Village’s residential treatment programs. Blackbaud is a cloud computing provider that offers customer relationship management and financial services tools to organizations, including Samaritan Daytop Village. The confidentiality, privacy, and security of information in its care is among Samaritan Daytop Village’s highest priorities, and Samaritan Daytop Village takes this incident very seriously. Please note that this incident did not involve any internal Samaritan Daytop Village systems.

What Happened? On July 16, 2020, Blackbaud reported to Samaritan Daytop Village that in May 2020, Blackbaud experienced a ransomware incident that resulted in the encryption of certain Blackbaud systems. Upon receiving notice of this incident, Samaritan Daytop Village immediately commenced an investigation and engaged independent counsel to better understand the nature and scope of the incident and any impact on Samaritan Daytop Village data. Blackbaud reported the incident to law enforcement and worked with forensic investigators to determine the nature and scope of the incident. Following its investigation, Blackbaud notified its customers that an unknown actor may have accessed or acquired certain Blackbaud customer data. Blackbaud has assured its customers, such as Samaritan Daytop Village, that no credit card information, bank account information, or social security numbers where accessed. Blackbaud reported that the data that was accessed was exfiltrated by the threat actor at some point before Blackbaud locked the threat actor out of the environment on May 20, 2020. Upon learning of the Blackbaud incident, Samaritan Daytop Village immediately commenced an investigation to determine what, if any, sensitive Samaritan Daytop Village data was potentially involved which included the manual review its internal files. On September 3, 2020, this review determined the data potentially affected may have contained protected health information.

What Information Was Involved? Samaritan Daytop Village’s investigation determined that the involved Blackbaud systems contained the name, address, and details of a check current or former patients received during or at the conclusion of their time at one of Samaritan Daytop Village’s residential treatment facilities. Please note that, to date, Samaritan Daytop Village has not received confirmation from Blackbaud that your specific information was actually accessed or acquired by the unknown actor.

What We Are Doing. As part of its ongoing commitment to the security of information in its care, Samaritan Daytop Village is working to review its existing policies and procedures regarding their third-party vendors, and are working with Blackbaud to evaluate additional measures and safeguards to protect against this type of incident in the future. Samaritan Daytop Village will also be notifying state and federal regulators, as required.

What You Can Do. While Samaritan Daytop Village noes not have any evidence that your information has been accessed or acquired and believe you may be impacted by this incident, you are encouraged to remain vigilant, to monitor your Explanations of Benefits for any services unrelated to you, and to report any suspicious activity to your insurance carrier and provider. Additionally, you can further educate yourself regarding steps you can take to protect yourself against identity theft by contacting the consumer reporting agencies, the Federal Trade Commission, or your state Attorney General. The consumer reporting agencies can be reached at:

Equifax
1-866-349-5191
P.O. Box 105069
Atlanta, GA 30348-5069
www.equifax.com

Experian
1-888-397-3742
P.O. Box 9554
Allen, TX 75013
www.experian.com

TransUnion
1-800-680-7289
P.O. Box 2000
Chester, PA 19022-2000
www.transunion.com 


The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580, by phone at 1-877-438-4338, or their website at www.identitytheft.gov. The New York Attorney General may be contacted at: The Office of Attorney General, The Capital, Albany, New York, 1222, by phone at 800-771-7755, or their website at https://ag.ny.gov/

For More Information. Samaritan Daytop Village understands that you may have questions about the Blackbaud incident that are not addressed in this letter. If you have additional questions, please call Samaritan Daytop Village’s dedicated assistance line at 888-490-0763 between the hours of 9:00 AM and 9:00 PM ET, Monday through Friday, excluding major U.S. holidays. You may also write to Samaritan Daytop Village at 138-02 Queens Boulevard, Briarwood, New York 11435.