Last week, Impact MHC, a Colorado-based mobile home park management company, agreed to pay $25,000 to the Colorado Attorney General’s office and implement new security measures after a data breach of more than 15,000 individuals’ personal information, including 719 Colorado residents. If Impact fails to implement such security measures (such as creating a written information disposal policy, a comprehensive cybersecurity program, and an incident response plan) within the allotted timeframe, it must pay an additional $30,000.
In October 2018, Impact discovered that hackers had used a phishing campaign to access its employees’ email accounts, which contained personal information of customers and employees, including Social Security numbers and financial information. The hackers had access to the account until July 2019. After discovery of this incident, Impact did not notify the affected Colorado residents for over 10 months. Colorado state data breach notification law requires notice of a breach within 30 days of discovery.
Attorney General Philip Weiser said, “Now more than ever companies must remain vigilant in the digital world. A data breach like the one at Impact MHC can put important consumer financial and personal information in the hands of the wrong people and cause significant harm to Coloradans and their families, as we have seen recently with regard to the unemployment insurance fraud that has led to over one million fraudulent claims. We will continue to hold companies accountable for safeguarding residents’ data.”