Purcellville Sends New Letters to Data Breach Victims

The nearly 2,000 individuals nationwide who were affected by a data breach that originated in the Town of Purcellville are getting new information on the status of their potentially compromised personal information.

            Town Manager David Mekarski on Nov. 25 sent new, more informative letters to the 1,800 individuals affected by a town data breach attributed to former interim Town Manager Alex Vanegas, who investigators say removed a 9.1-gigabyte flash drive with thousands of pieces of sensitive information from the Town Hall.

            An investigation conducted by the McDonald Hopkins law firm and the Beazley cyber services firm resulted in the law firm sending letters to 1,800 affected individuals on Oct. 17 notifying them of the concern. Because the firm sent those letters on town stationary but included its own Harrisburg, PA, address and phone number, some recipients questioned the validity of the alert.

In response, Mekarski two weeks ago sent new letters on town stationary with his name and his signature on them. According to the letter, they were sent “to verify the legitimacy of the prior correspondence, provide [those affected] with additional information about how the town had [their] information and remind [them] about the services [the town is] making available.”

Of the 1,800 affected, 1,740 were from the Fairfax County Police Department.

According to Mekarski’s letter, the town was in possession of those individuals’ information because a Purcellville employee who formerly worked in Fairfax County attached a standard Fairfax County form to an email that was sent to Police Chief Cynthia McAlister. That form featured a hidden field that included the individuals’ social security numbers, but not their dates of birth or other personal information.

The town is continuing to assist Fairfax County with the breach and is reminding those affected to take advantage of a free one-year membership to the Experian IdentityWorks Credit 3B identity protection service. Affected individuals have until Dec. 31 to activate their Experian accounts.

According to Lisa Connors, the acting director of the Fairfax County Police Department’s Media Relations Bureau, the department is still looking into the situation.

[email protected]

Leave a Reply