Oskaloosa Community School DistrictAddresses Timberline Data Security Incident
OSKALOOSA, IOWA (OCTOBER 20, 2020) – Beginning today, Timberline Billing Service, LLC (“Timberline”) is mailing letters to students of several Iowa school districts notifying them of a privacy incident that may have involved some of their information. Timberline provides Medicaid billing and reimbursement services to over 190 school districts in Iowa, including Oskaloosa Community School District (the “District”).
On September 2, 2020, Timberline informed the District that an unknown actor accessed its network between February 12, 2020 and March 4, 2020, encrypted certain files, and removed certain information from its network. Timberline immediately began an investigation to determine what information was involved. This incident did not involve any access to District’s internal systems or student records.
Because Timberline’s investigation was unable to determine what information was actually removed, Timberline reviewed all files that could have been accessed by the unknown actor. Timberline’s review determined that the files contained information for some current and former students of the District, including names, dates of birth, Medicaid identification number, and related billing information. Importantly, the files did not contain student Social Security numbers, credit card numbers, or financial account information.
Timberline is not aware of any misuse of the data as a result of this incident. However, in an abundance of caution, Timberline is offering affected students complimentary credit monitoring and identity protection services. Timberline also established a dedicated call center to answer any questions parents or students may have about this incident. This call center can be reached at (844) 439-7669, Monday through Friday, between 8:00 a.m. and 10:00 p.m. Central Time.
To help prevent something like this from happening again, Timberline is taking steps to enhance the security of its systems including upgrading all servers and firewalls, resetting all user passwords, requiring frequent password rotations, and migrating school and student data to a cloud location.
