School district informs public of possible data breach

By James Grob, jgrob@charlescitypress.com

The Charles City School District released a statement this week to inform the public of a data security incident involving Timberline Billing Services.

Timberline provides Medicaid reimbursement billing services for covered individualized education plan (IEP) services to 190 school districts in Iowa, including Charles City.

In September, Timberline notified Charles City that the company had experienced a cybersecurity incident which resulted in the exposure of personal information maintained by educational institutions and processed by Timberline.

In March, Timberline noticed suspicious activity on its network impacting certain servers and systems. Timberline launched an investigation to determine the nature and scope of this activity, according to information posted on the school district website.

“Working with outside computer forensics specialists, Timberline determined that an unknown actor accessed Timberline’s network between February 12, 2020 and March 4, 2020, encrypted certain files, and also removed certain information from Timberline’s network; however, the investigation was unable to determine which specific information was actually removed,” the statement says.

“Timberline undertook a comprehensive review of all files that could have been impacted. This review was recently completed and determined that protected health information and/or personal information relating to student information was present in files that may have been compromised,” the school district statement says.

Timberline’s investigation determined the following types of student information may have been involved: name and Medicaid ID number, billing or claims information, date of birth, medical record number, support service code and identification number, and treatment information.

“To date, Timberline is unaware of any actual or attempted misuse of personal information as a result of this incident, in Charles City or elsewhere,” the statement says.

Timberline is offering affected students access to 12 months of minor identity monitoring through Experian at no cost. Timberline has established a dedicated assistance line for individuals seeking additional information regarding this incident. Individuals seeking additional information may call toll-free assistance line at (844) 439-7669.