RICHMOND, Va. — A state website is down for a second day after a technical glitch exposed Virginians’ personal information, as state officials conduct an internal investigation.
Those people were trying to apply for the Individual and Family Support Program, IFSP, which provides state assistance to families with loved ones that have a disability who are also on the waitlist for a Medicaid waiver. The program is overseen by the Department of Behavioral Health and Developmental Services. Applicants are reviewed in the order they are received.
The application process opened at 9 a.m. Tuesday for the program. A department spokesperson said in an email that the website was shut down at 9:16 a.m.
Ebony Cunningham, of Chesterfield County, was sitting at her desk before the website went live Tuesday to submit applications for both of her boys, Jaxson and Xavier. The 5-year-old twin boys have autism and are non-verbal. Funding from the program would help pay for communication devices for the boys as well as therapy.
“It’s extremely tough. I’m a single parent,” Cunningham explained. “The extra funding for me for the services and the therapy that my boys could receive.”
After hitting submit, Cunningham received three emails with identification numbers to sign onto the program’s portal. Other email addresses were copied to them of people she didn’t know.
When she signed online, Cunningham viewed another applicant’s personal information including Social Security numbers and home addresses. Other concerned viewers also experienced the same thing when signing onto the program’s website.
DBHDS spokesperson Maria Reppas said in an email, “Medical records were never accessible. Personal information was accessible during the period when the site was live.”
The DBHDS is conducting an internal investigation to figure out what happened and how many people were affected. It’s being led by VITA’s Incident Response team as well as DBHDS’s Information Technology staff, Reppas says.
The deadline for the IFSP application process is Oct. 11 at 5:00 p.m. DBHDS is assessing the application deadline and will make a decision about whether or not there will be changes no later than Friday. Reppas said in an email that the department will give at least 48 hours notice before the site is relaunched so applicants can prepare to submit their information. Information about the relaunch will be sent through the program’s listserv.
“We also plan to confirm the status of the applications that were submitted on October 1st so that families know exactly where their applications stand,” Reppas said.
In an email to applicants sent Wednesday afternoon, DBHDS said they will contact applicants directly if their information was affected.
Waiting for answers is tough for parents whose children’s personal information may have been seen by others.
“It’s terrifying,” Cunningham said. “I’m worried for myself, my kids and everybody else who’s information is out there.”
So what do you do? The Better Business Bureau Serving Central Virginia does not work directly with state agencies, but many come to them who are concerned about their personal information was exposed.
“Call your banks, request a credit freeze,” Barry N. Moore of the BBB Serving Central Virginia said. “Also request a courtesy check to see if your child’s information is showing up in any recent banking applications.”
Credit reports can be checked on three bureaus: Experian, TransUnion and Equifax. If you request a free credit freeze, also known as a security freeze, it can make it harder for someone to open new accounts.
Since 2013, nearly 9,000 individuals have been served by the IFSP, primarily getting financial assistance which has totaled more than $13 million. A department spokesperson says more than $6 million was allocated by the General Assembly for IFSP payments for families in the state budget over the past two years.