Smith, Gambrell & Russell, LLP (“SGR”) is notifying potentially affected individuals of a data security incident that may have involved their information. SGR is a law firm that provides services to primarily corporate clients and, in that capacity, was provided with personal information in the performance of services for the following company: Aaron’s, LLC (the “Company”).
On August 9, 2021 SGR learned that some documents may have been taken from a part of its information technology systems by an unauthorized person. SGR immediately implemented its incident response protocols, contacted law enforcement, and hired external computer forensic specialists and other consultants to address the incident and to investigate what occurred and what data may have been impacted. The investigators identified a number of documents that may have been taken. SGR then hired a vendor to review the potentially impacted documents to identify any personal information contained within them. This review was only recently completed, at which point SGR learned that some personal information may have been in the impacted documents. SGR has no indication that any of information was misused and is providing notice out of an abundance of caution.
What Information Was Involved?
From the review, it appears that the impacted documents may have included individuals’ names, and some combination of the following: address, Social Security numbers, driver’s license numbers, government IDs, medical information such as treatment, diagnosis and medical history.
What We Are Doing:
SGR has taken, and continues to take, steps to prevent a similar incident from happening in the future. Since the incident, SGR deployed enhanced endpoint monitoring software on computers and servers, performed a global password reset for all users, provided additional security training, and implemented several other security controls. SGR also notified and are cooperating with law enforcement.
In addition, SGR is offering credit monitoring and identity theft protection services through IDX. Contact 1-833-423-2985 Monday through Friday, from 9 am – 9 pm Eastern Time to determine whether you were impacted and can enroll in these services.
What You Can Do:
Potentially affected individuals should review credit reports, bank account and other financial statements, and immediately contact their financial institution if they identify suspicious activity. Additional recommended steps to help protect your identity can be found below (see “Recommended Steps to Help Protect Your Information”).
For More Information:
Potentially affected individuals should contact 1-833-423-2985 Monday through Friday from 9 am – 9 pm Eastern Time with any questions. SGR and the Companies take very seriously the need to protect the privacy and security of all information in their respective care, and deeply regret any inconvenience or concern that this matter may cause.
Recommended Steps to Help Protect Your Information
Review credit reports. Remain vigilant by reviewing account statements and monitoring credit reports. Under federal law, individuals also are entitled every 12 months to one free copy of their credit report from each of the three major credit reporting companies. To obtain a free annual credit report, go to www.annualcreditreport.com or call 1-877-322-8228. Callers may wish to stagger their requests so that they receive a free report by one of the three credit bureaus every four months.
Individuals have the right to file a police report if they experience identity fraud. To file a crime report or incident report with law enforcement for identity theft, law enforcement usually requires some kind of proof that you have been a victim. A police report is often required to dispute fraudulent items. Individuals can report suspected incidents of identity theft to local law enforcement or to the Attorney General.
Place Fraud Alerts with the three credit bureaus. Fraud alert can be placed at one of the three major credit bureaus by phone and also via Experian’s or Equifax’s website. A fraud alert tells creditors to follow certain procedures, before they open any new accounts or change existing accounts. For that reason, placing a fraud alert can offer protection, but also may cause a delay if an individual seeks to obtain credit. The contact information for all three bureaus is as follows:
|Equifax Fraud Reporting
P.O. Box 105069
Atlanta, GA 30348-5069www.equifax.com
Experian Fraud Reporting
|TransUnion Fraud Reporting
P.O. Box 2000
Chester, PA 19022-2000www.transunion.com
It is necessary to contact only ONE of these bureaus and use only ONE of these methods. As soon as one of the three bureaus confirms the fraud alert, the others are notified to place alerts on their records as well. Confirmation letters are sent in the mail and the individual can then order all three credit reports, free of charge. An initial fraud alert will last for one year.
Security Freeze. By placing a security freeze, someone who fraudulently acquires an individual’s personal identifying information will not be able to use that information to open new accounts or borrow money in their name. All three national credit reporting bureaus listed above should be contacted to place the freeze. Keep in mind that when the freeze is placed, individuals will not be able to borrow money, obtain instant credit, or get a new credit card until the freeze is temporarily lifted or permanently removed. There is no cost to freeze or unfreeze credit files.
The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. Contact information for various states is provided below.
California Residents: Visit the California Office of Privacy Protection (www.oag.ca.gov/privacy) for additional information on protection against identity theft.
Kentucky Residents: Office of the Attorney General of Kentucky, 700 Capitol Avenue, Suite 118 Frankfort, Kentucky 40601, www.ag.ky.gov, Telephone: 1-502-696-5300.
Maryland Residents: Office of the Attorney General of Maryland, Consumer Protection Division 200 St. Paul Place Baltimore, MD 21202, www.oag.state.md.us/Consumer, Telephone: 1-888-743-0023.
New York Residents: The Attorney General may be contacted at: Office of the Attorney General, The Capitol, Albany, NY 12224-0341; 1-800-771-7755; https://ag.ny.gov/.
North Carolina Residents: Office of the Attorney General of North Carolina, 9001 Mail Service Center Raleigh, NC 27699-9001, www.ncdoj.gov, Telephone: 1-919-716-6400.
All US Residents: Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue, NW Washington, DC 20580, www.identitytheft.gov, 1-877-IDTHEFT (438-4338), TTY: 1-866-653-4261.