Cybercrime response: 850K+ data breach victims notified in one week; $18K saved
A State Agency discovered that individuals utilizing an online tool to look for jobs may have had their information compromised via a security vulnerability. This affected 851,220 individuals’ records. Under the state and federal laws regarding the safeguarding of personally identifiable information (PII) the state was required to notify potentially affected individuals via USPS First Class Mail.
The state contacted Epiq for its printing and mailing services on Monday afternoon with a request to begin mailing Thursday and complete the mailing the following Monday. Epiq received raw data and performed standardized data normalization and clean up. The data was processed to locate and expunge duplicate records and then compared against the USPS National Change of Address (NCOA) database. The overall process reduced the total number of individuals from 851,220 to 814,093 and saved the state more than $18,000 in postage and mailing expense. Additionally, the NCOA update improved the overall success and adequacy of their notice to individuals.
Epiq also provided call center services, ramping to 350 live, in-house trained agents in under a week, located in Portland, Oregon and New York; and creating and recording interactive voice response (IVR) scripts.
Mail was delivered to the USPS on the state’s schedule: 250,000 pieces of mail each day Thursday and Friday and the balance of the mail delivered on Monday. Call volume followed the delivery volume of mail.
Call volume peaked immediately after the bulk of the mail was delivered with a call volume of 7,230. The nature of a data breach is that call volume spikes early in the matter, then drops quickly and maintains a steady volume for a number of weeks. On a daily basis the volume of calls is evaluated using predictive modeling software and Epiq reduces the number of agents to ensure service level agreements are met without overstaffing. After the first six days, call volumes began to drop, and after two weeks the call volume required under 100 agents. This matter is still ongoing and the number of agents will continue to decline until there is no longer a need for dedicated agents. At that point, a pool of trained agents will handle these calls in Epiq’s shared resource model where agents will provide support across multiple cases.