Dakota County experienced a data security incident that may have involved private information belonging to certain individuals. Dakota County sent notification of this incident via U.S. Mail and email to potentially impacted individuals and provided resources to assist them. However, after a diligent search, Dakota County did not have sufficient contact information for all potentially impacted individuals, and accordingly, this notice is being provided for the benefit of those individuals who could not be directly sent a notification.
On April 5, 2024, Dakota County discovered unusual activity in its email tenant. Upon discovering this activity, Dakota County immediately took steps to secure the accounts and launched an investigation, aided by independent cybersecurity experts, to determine what happened and whether private information may have been affected. As a result of the investigation, Dakota County learned that an unauthorized actor accessed certain emails and files maintained by Dakota County. In response, Dakota County launched a comprehensive review of all potentially affected information to identify any private information that could have possibly been accessed. Following the completion of this comprehensive review, Dakota County confirmed on August 27, 2024, that private information may have been involved in the incident. Dakota County has been working diligently to gather contact information for individuals and to prepare notification to all affected individuals of this incident. Dakota County is not aware of any evidence that the information potentially involved in this incident was removed, downloaded, or misused.
On October 11, 2024, Dakota County provided notice of this incident to potentially impacted individuals whose contact information could be verified. In so doing, Dakota County provided information about the incident and about steps that potentially impacted individuals can take to protect their information.
The following information may have been involved in the incident for those individuals who are receiving substitute notice: names, information identifying individuals as those who applied for or received services from the Social Services department, and in some cases, information about those services, dates of birth and contact information.
Dakota County has established a toll-free call center to answer questions about the incident and to address related concerns. Call center representatives are available at 833-251-9667, Monday through Friday from 8 a.m.–8 p.m. Central.
Dakota County takes the security and privacy of information in its possession very seriously and is taking steps to prevent a similar event from occurring in the future. The privacy and protection of personal information is a top priority for Dakota County, which deeply regrets any inconvenience or concern this incident may cause.
Steps You Can Take to Protect Your Information
Review Your Account Statements and Notify Law Enforcement of Suspicious Activity: As a precautionary measure, we recommend that you remain vigilant by reviewing your account statements and monitoring free credit reports closely for errors and by taking other steps appropriate to protect accounts, including promptly changing passwords. If you detect any suspicious activity on an account, you should promptly notify the financial institution or company with which the account is maintained for remediation assistance or contact a remediation service provider. You also should promptly report any fraudulent activity or any suspected incidence of identity theft to proper law enforcement authorities, your state attorney general, and/or the Federal Trade Commission (FTC). You should also contact your local law enforcement authorities and file a police report. Obtain a copy of the police report in case you are asked to provide copies to creditors to correct your records. Contact information for the Federal Trade Commission is as follows:
Copy of Credit Report: You may obtain a free copy of your credit report from each of the three major credit reporting agencies once every 12 months by visiting http://www.annualcreditreport.com/, calling toll-free 877-322-8228, or by completing an Annual Credit Report Request Form and mailing it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348. You can print this form at https://www.annualcreditreport.com/cra/requestformfinal.pdf. You also can contact one of the following three national credit reporting agencies:
- Equifax, P.O. Box 740241, Atlanta, GA 30374, 1-800-525-6285, www.equifax.com.
- Experian, P.O. Box 9532, Allen, TX 75013, 1-888-397-3742, www.experian.com.
- TransUnion, P.O. Box 1000, Chester, PA 19016, 1-800-916-8800, www.transunion.com.
Fraud Alerts: There are two kinds of general fraud alerts you can place on your credit report—an initial alert and an extended alert. You may want to consider placing either or both fraud alerts on your credit report. An initial fraud alert is free and will stay on your credit file for at least 90 days. The alert informs creditors of possible fraudulent activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. You may have an extended alert placed on your credit report if you have already been a victim of identity theft and provide the appropriate documentary poof. An extended fraud alert is also free and will stay on your credit report for seven years. To place a fraud alert on your credit report, contact any of the three credit reporting agencies identified above. Additional information is available at http://www.annualcreditreport.com. Military members may also place an Active-Duty Military Fraud Alert on their credit reports while deployed. An Active-Duty Military Fraud Alert lasts for one year and can be renewed for the length of your deployment.
Credit or Security Freezes: Under U.S. law, you have the right to put a credit freeze, also known as a security freeze, on your credit file, for up to one year at no cost. The freeze will prevent new credit from being opened in your name without the use of a PIN number that is issued to you when you initiate the freeze. A security freeze is designed to prevent potential creditors from accessing your credit report without your consent. As a result, using a security freeze may interfere with or delay your ability to obtain credit.
You must separately place a security freeze on your credit file with each credit reporting agency. There is no fee to place or lift a security freeze. For information and instructions on how to place a security freeze, contact any of the credit reporting agencies or the Federal Trade Commission identified above. In order to place a security freeze, you may be required to provide the consumer reporting agency with information that identifies you including your full name, Social Security number, date of birth, current and previous addresses, a copy of your state-issued identification card, and a recent utility bill, bank statement or insurance statement. After receiving your freeze request, each credit bureau will provide you with a unique PIN or password. Keep the PIN or password in a safe place as you will need it if you choose to lift the freeze.
A freeze remains in place until you ask the credit bureau to temporarily lift it or remove it altogether. If the request is made online or via phone, a credit bureau must lift the credit freeze within an hour. If the request is made by mail, then the bureau must lift the freeze no later than three business days after receiving your request.
IRS Identity Protection PIN: You can obtain an identity protection PIN (IP PIN) from the IRS that prevents someone else from filing a tax return using your Social Security number. The IP PIN is known only to you and the IRS and helps the IRS verify your identity when you file your electronic or paper tax return. You can learn more and obtain your IP PIN here: https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin.
You also have certain rights under the Fair Credit Reporting Act (FCRA): These rights include the right to know what is in your file; to dispute incomplete or inaccurate information; to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For more information about the FCRA, and your rights pursuant to the FCRA, please visit http://files.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf.
Additional Free Resources: You can obtain information from the consumer reporting agencies, the FTC, or from your respective state attorney general about fraud alerts, security freezes, and steps you can take toward preventing identity theft. You may report suspected identity theft to local law enforcement, including to the FTC or to the attorney general in your state.
Report:
Dakota County is preparing a report detailing the facts and results of this incident. You may request a copy of the report by email to data.practices@co.dakota.mn.us, or by mail to Dakota County, Attn: Data Privacy Officer, 1590 Highway 55, Hastings, MN 55033.