WASHINGTON, Aug. 07, 2021 (GLOBE NEWSWIRE) — ibex today issued this announcement concerning an earlier event, disclosed by the company on October 23, 2020 in its Annual Report (Form 20-F), which may have potentially impacted the security of information relating to certain employees and their families. While ibex is unaware of any attempted or actual misuse of personal information in relation to the event, ibex provided potentially affected individuals with notice, information about the event and steps individuals can take to help protect their information.
On August 17, 2020, ibex learned that it was the victim of a malware attack that impacted the availability of a limited segment of our systems. We immediately took these systems offline and, with the assistance of third-party computer specialists, launched an investigation to determine the nature and scope of the incident. On or about September 15, 2020, the investigation confirmed that certain files on our systems may have been accessed without authorization between July 27 and August 17, 2020. We therefore undertook a meticulous and time-intensive review of the potentially impacted files and our internal systems in order to identify the information that was involved and to whom it related. In connection with this review, on or about September 29, 2020, a third-party firm was engaged to review the potentially impacted files. ibex, upon receiving and validating the findings of the third-party firm, on or about June 14, 2021, determined that one or more of the potentially impacted folders included information related to individuals.
In conjunction and collaboration with the third-party review team, ibex continued to diligently review and reconcile the information with internal and public records in furtherance of identifying the individuals to whom the data relates and the appropriate contact information for those individuals. These efforts were completed on or around July 11, 2021, at which time ibex determined the scope of impacted individuals and the types of protected data associated with those individuals.
We thereafter worked to provide notification to potentially impacted individuals as quickly as possible. Importantly, there is no indication that any person’s specific information was accessed or misused. However, ibex is notifying potentially impacted individuals out of an abundance of caution.
Information security is important to us, and we have strict security measures in place to protect information in our care. Upon discovering this incident, we immediately took steps to review and reinforce the security of our systems. We have implemented additional cybersecurity measures to further protect against similar incidents moving forward. Additionally, ibex is providing potentially impacted individuals with complimentary access to identity monitoring, fraud consultation, and identity theft restoration services.
ibex encourages individuals to monitor their accounts and activate the complimentary credit monitoring and identity protection services being offered. Please see the section below for more information. Individuals may call ibex’s call center at 866-871-8614 (toll free), Monday through Friday from 9 am to 9 pm Eastern Time. Potentially affected individuals may also consider the information and resources outlined below.
Read more on Globe Newswire.
It cannot possibly be okay to take almost a year to notify people, no matter how diligent you claim you are being. Ibex is not the only firm to have notified after a long gap, and there really needs to be an enforceable time frame by which notifications must be made. If firms need to hire more help to investigate, then hopefully their insurance will cover more help, but a one year lag to notification is really not okay — even if you claim that there is no evidence blahblahblah.
I am not saying that there should be a private cause of action for delayed notification, but maybe state attorneys general should get laws enacted that they enforce with monetary penalties based on the length of time it took to notify. I don’t know…. something…. but this is really not an acceptable gap to notification.
A one year gap is not acceptable. My data as a former employee should not have been on your database, as it has been 5 years since I left the company
You received a notification that your data was caught up in this?
I am unsure what ibex is….. I received in the mail yesterday the notification of data pertaining to me may have been compromised, but through what account? I have never even heard of “ibex” so how do I even know if I personally have data through their company? Are they a representative for a credit card, bank, retail company? I just don’t know nor have I found any helpful information as of yet.
Well, their notice says it impacted certain employees and their families. If you yourself weren’t an employee, then did you have any relative who may have listed you as a dependent on a health insurance plan or retirement plan through the company? And if not, maybe you should call the call center number in the notice and ask them how Ibex got your data.
I was confused too, I believe them to be a former employer of mine (different name now) that ran call centers. If you’ve ever done work like that, I would guess that could be the same for you.