SALT LAKE CITY – In the Capitol Board Room this afternoon, Utah Governor Gary R. Herbert, flanked by agency leadership, detailed the State’s comprehensive response to the recent health and Medicaid data breach. The State response includes a full-scale, independent audit of technology security systems, the appointment of a new health data security ombudsman, investigation by law enforcement, and personnel action.
“The State of Utah must restore the trust placed in it,” the Governor said.“Cyber-security is the modern battlefront and we are all enlisted—you, me, our state agencies, the Legislature—all of us have a critical role to play,” he added.
Confirming that the March 30 unauthorized transfer of personal files from state servers was an isolated incident, the Governor apologized to the approximately 280,000 individuals whose Social Security Numbers were compromised, as well as approximately 500,000 others who had less sensitive information also stored on the server. “The compromise of even one person’s private information is a completely unacceptable breach of trust,” said the Governor. “The people of Utah rightly believe that their government will protect them, their families and their personal data. As a state government, we failed to honor that commitment. For that, as your Governor and as a Utahn, I am deeply sorry.”
According to law enforcement authorities, cyber attacks on public information systems have increased 600% this year, resulting in nearly a million attempts daily by cyber terrorists or hackers to infiltrate the State IT network. That reality, coupled with the recent data breach, prompted the Governor to call for a comprehensive, independent security audit of information technology systems, both for this incident and across all agencies. The security audit, conducted by Deloitte & Touche, is now underway, as is a parallel assessment of the State’s response to victims.
Another critical part of the State’s response is Governor Herbert’s appointment of Sheila Walsh-McDonald as the new Health Data Security Ombudsman. She will oversee individual case management, credit counseling and public outreach. The Governor said, “Sheila is a trusted and experienced member of the public health and advocacy community, having dedicated her 33-year professional career to working on behalf of Utah’s disparate populations, with a focus on improving and strengthening the public and private programs that serve them. It is truly an honor to have Sheila on board in this effort and I thank her for her willingness to serve.”
During today’s event, the Governor also announced the resignation of Stephen Fletcher, executive director of the Dept. of Technology Services (DTS), and the subsequent appointment of 28-year IT veteran Mark VanOrden as acting director of DTS. VanOrden is the IT director for the Utah Dept. of Workforce Services and recent recipient of the Merrill Baumgardner award for excellence.
“Right now, I am counting on Mark’s well-established ability to pull the DTS team together to focus on optimizing the value of Deloitte’s audits and our efforts to rebuild public trust in our IT systems and processes,” said Governor Herbert.
The Governor urged impacted individuals and families to contact the Utah Department of Health hotline (1-855-238-3339) with any questions and encouraged them to enroll in free credit monitoring. He further cautioned citizens to beware of scammers and those who prey on the vulnerable and ill-informed.
“Please know that no one from the State will contact you and ask for information over the phone or via email regarding this incident. Do not provide private information, especially not a Social Security Number or account information, in response to a phone call or email you did not initiate,” the Governor said. “This incident is a tragic reminder that it is a different world in which we live. The dynamics continue to change and there is a very real and growing cyber threat.”
Contact: Ally Isom
Deputy Chief of Staff
801.538.1503 desk
801.864.7268 cell
