The Equifax data breach is the largest data breach in our nation’s history. With 143 million Americans and 240,000 Vermonters at risk, I heard from many friends, neighbors and constituents asking the question, “What should I do? How can I protect my family?” The data breach left my family and me asking the same questions.
Directly after the breach my Public Protection Division began getting the word out to Vermonters with action steps they could take to protect their data. Our Consumer Assistance Program set up a hotline for Vermonters to call to get information about the data breach. In response, our team returned over 700 calls to make sure people had the information and the support they needed to act. Our Public Protection Division launched an investigation into Equifax to ensure that we hold this company accountable for putting Vermonters at risk. That investigation continues today. I am proud of the work our team has done in response to this data breach. However, the breach highlights how cyber security is an issue that affects us all, and we could all learn more about how to protect our data.
October is National Cyber Security Awareness Month. This initiative is over a decade old, but over the last few years, Vermonters have started to appreciate the challenges of living in an internet-connected world. On the one hand, most of us appreciate the ease of communicating or engaging in commerce online. On the other hand, there are risks and dangers for consumers using the internet that our parents and grandparents could not have imagined. The Attorney General’s Office speaks with Vermonters every day who are barraged with phishing scams, robocalls, and in some cases identity theft — much of which are facilitated through information gleaned from the internet. Hackers can, and will, hit anyone. The recent Equifax breach exposing a quarter-million Vermonters’ sensitive data has made this abundantly clear.
Consumer protection online is more important than ever and it is a top priority for my office. To that end, we are taking action. In response to online consumer protection and scam activity, we have:
•  Initiated a free Vermont “Scam Alert” system with the Department of Public Safety to notify Vermonters when new or prevalent scams appear (type “consumer.vermont.gov” into your browser to learn more or sign up);
•  Engaged retailers and utilities in a public education and awareness campaign to stop scams from happening;
•  Launched an investigation into the Equifax breach to ensure it is held accountable for its massive failure to protect Vermonters’ information;
•  Worked with businesses that suffer data breaches to help them comply with the law and make sure that Vermonters’ are properly notified;
•  Held public hearings with the Department of Financial Regulation on data brokers (data brokers collect, purchase and sell consumer information. In December, we will issue a report with common sense recommendations); and
•  We are presenting at Tech Jam 2017, in partnership with the Department of Financial Regulation, Champlain College and Facebook, on cybersecurity for small businesses.
Over the years we have imposed hundreds of thousands of dollars in penalties on businesses that do not properly protect Vermonters’ data, or fail to notify businesses when breaches occur. We were involved in major settlements including TJX, Health Net, Target and TD Bank. Last week we announced a $264,000 settlement related to a company that accidentally exposed the Social Security Numbers of 660 Vermont Health Connect subscribers, and then failed to provide timely notification.
We are redoubling our efforts in this area. Our Small Business Advocate is traveling around the state with assistant attorneys general talking to business organizations and business owners about security and breach response. Beginning in October, we are visiting high schools around the state to teach students about online privacy, scams, and security.
The culmination of our most recent outreach efforts will be at Tech Jam 2017 in Essex on Oct. 20. Together, we will provide small businesses with critical information necessary to keep themselves, and the rest of Vermonters, safe. Tech Jam is a free event and I encourage all business owners to attend our panel on cybersecurity for small businesses. You can register online at sevendaystickets.com/events/48232272/2017-vermont-tech-jam-what- the-hack.
It’s time to roll up our sleeves, get creative, and figure out how we can do what’s best for Vermonters. Cybersecurity is critical to Vermont’s online future. I’m proud of the work our office has done to protect Vermonters. We will continue to raise public awareness of this issue, alert the public when a problem arises, seek creative solutions to cyberthreats, and enforce the laws of the state of Vermont.
Editor’s note: TJ Donovan is Vermont’s attorney general.