PURCELLVILLE, Va. November 15, 2019 – As reported by the Town Manager in a press release on Sunday, November 10, 2019, the Town Manager learned in 2018 that an unauthorized individual - who was neither employed nor contracted by the Town - claimed to have obtained a complete copy of a Town employee’s work email account. The Town’s investigators were unable to verify the claim, and the Town has no direct evidence regarding how, or if the unauthorized individual obtained the contents of the email account.
In the absence of certainty concerning the claim of unauthorized access, the Town took precautions to (a) ascertain the scope of the data allegedly taken, and (b) to protect those potentially affected. The Town preserved an exact copy of the email account as it existed when the claim by the unauthorized person was made, and engaged external data security and privacy professionals to identify all personally identifying information within that account. An extensive forensic examination of the data was conducted which included a programmatic and manual review. Those individuals whose sensitive personal information was contained in the email account were identified, and the Town, through its consultants, notified those individuals by correspondence dated November 6, 2019 via U.S. Mail.
Of the approximately 1,800 individuals notified, only 25 individuals were associated with a Purcellville address, and 1,740 individuals were affiliated with a single outside entity. As pertains to the 1,740 individuals, their personal information was embedded on a single document – a standardized form that was created by the single outside entity. That standardized form was utilized by a Town employee, and attached to an email sent to the Town’s Chief of Police, Cynthia McAlister. The personal information of the 1,740 individuals was contained in a hidden field that was not visible on the face of the standardized form, and neither the employee who utilized the form nor the Town’s Chief of Police was aware of the hidden data. The Town has notified the single outside entity of the incident, and the hidden data.
The November 6, 2019 notice letter from the Town concerning this incident provides each of the approximate 1,800 recipients a full explanation about how to proceed. The Town encourages the recipient of each such letter to take advantage of the services being offered by the Town, as described in the letter, including enrollment in the credit monitoring services offered at no charge to letter recipients.
