Nonprofit drug and alcohol rehabilitation organization Phoenix House is notifying about 2,000 employees and former employees that a former consultant – who had access to personal information – appears to have made unauthorized changes to the electronic payroll system hosted by third parties.

How many victims? Approximately 2,000 people may have been impacted.

What type of personal information? Names, addresses, Social Security numbers, salaries, and benefit information.

What happened? A former consultant hired to perform payroll activities for Phoenix House appears to have made unauthorized changes to the electronic payroll systems hosted by third parties. The former consultant had access to personal information.

What was the response? Upon learning of the incident, Phoenix House removed the former consultant's access to the systems at issue and conducted an investigation to determine what information may have been changed. Phoenix House terminated the consultant's contract, reported the incident to law enforcement, and is cooperating with law enforcement in its investigation. Phoenix House is working to restore the information to its state before the incident and to update the files for authorized changes that have occurred since the incident. Phoenix House is conducting a comprehensive review of its information security practices and procedures. All potentially impacted individuals are being notified, and offered a free year of identity protection services.

Details: On Dec. 22, 2014, Phoenix House learned that, on Dec. 19, 2014, the former consultant appears to have made the unauthorized changes.

Quote: “While we have received no reports that your information has been used in any manner that would compromise your identity or credit, out of an abundance of caution, we want to let you know this happened and assure you that we take it very seriously,” Michael Berkowitz, SVP and director of Human Resources and Workforce Development, wrote in the notification letter.

Source: oag.ca.gov, “Phoenix House Individual Notification,” Feb. 5, 2015; a Monday email correspondence with a Phoenix House spokesperson.