The Florida Healthy Kids Corporation (FHKC) today announced a cybersecurity incident experienced by its vendor, Jelly Bean Communications Design, LLC., which was responsible for hosting the FHKC website at the time of the incident. The security incident involved the personal data of online applicants and enrollees. FHKC has no confirmation at this time that anyone’s personal information was removed from the system.
FHKC was notified on December 9, 2020, that several thousand applicant addresses had been inappropriately accessed and tampered with. These addresses are collected as part of the online Florida KidCare application. FHKC engaged independent cybersecurity experts to conduct a thorough review of the incident to confirm the scope and severity of the security incident.
The cybersecurity experts identified significant vulnerabilities in the hosted website platform and the databases that support the online Florida KidCare application. FHKC learned that these vulnerabilities spanned a seven-year period from November 2013 until December 2020. FHKC temporarily shut down the website and databases in December 2020.
The tampering of applicant addresses, together with the potential exposure of personal information dating back to November 2013, constitutes a reportable data breach under Florida and federal law.
The types of information that may have been exposed include:
- Full Name and Date of Birth
- Email Address and Telephone Number
- Physical Address and Mailing Address, if different
- Social Security Number
- Financial Information, to include wages, alimony, child support, royalties, other income, and tax deductions
- Family relationships of those individuals included on the Florida KidCare Application (i.e. mother of child, sister/brother of applicant, etc.)
- Secondary Insurance Information
What Consumers Can Do To Protect Themselves
Individuals who applied or enrolled with Florida KidCare coverage between November 2013 – December 2020 are encouraged to take readily available steps to protect themselves from potential harm, including:
- Fraud alerts – Fraud alerts are a free service offered by all three national credit reporting agencies (Experian, Equifax and TransUnion) and requires potential creditors to contact an individual before any new account is opened. Fraud alerts remain in place for one year, and consumers only need to contact one credit agency for all three credit agencies to place a fraud alert on an account.
- Security freezes – Security freezes are beneficial tools for parents to protect children who have no need for credit accounts. A security freeze, also known as a credit freeze, is the best way to prevent new accounts from being opened without a person’s permission. It is a free service offered by all three national credit reporting agencies (Experian, Equifax and TransUnion) that prevents new credit accounts from being opened under someone’s name without written authorization. Be aware that a security freeze will impact the ability to apply for new credit (such as a car loan, home loan, credit card, etc.). Unlike a fraud alert, consumers must contact each credit reporting agency separately to set up a security freeze.
- Monitoring – Close monitoring of all credit card, bank, and credit agency reports for any unusual activities is recommended. For additional information on how to protect one’s identity and to report identity theft, visit the Federal Trade Commission’s website at www.ftc.gov.
To set up a fraud alert or security freeze, please contact the three national credit reporting agencies below:
- Equifax: 1-800-525-6285; www.equifax.com
- Experian: 1-888-397-3742; www.experian.com
- TransUnion: 1-800-680-7289; www.transunion.com
FHKC is committed to taking every reasonable step to prevent future breaches, which will include a review of our current security practices and policies to identify ways to strengthen them. FHKC is accelerating efforts previously underway to transition the website to a new vendor. These efforts will help ensure family information is protected.
Information has been posted on the FHKC website, www.healthykids.org, where consumers can learn more information and read frequently asked questions. Consumers can also email questions to [email protected], or call 1-888-540-KIDS (5437) Monday-Friday from 7:00 am–7:00 pm EST.
About the Florida Healthy Kids Corporation
The Florida Healthy Kids Corporation is a nonprofit, public-private partnership created by the Florida Legislature to expand access to affordable, child-centered health insurance. The Corporation administers Florida Healthy Kids (healthykids.org), a comprehensive health and dental insurance program for Florida children from age 5 through the end of age 18. The Corporation also provides marketing, customer services and administrative services for Florida KidCare.
