Notice of Data Incident

What Happened

The City of Tomball, Texas (“City”) was subject to a criminal ransomware attack on or around December 20, 2022 (the “Incident”). With assistance from third-party experts, The City took immediate steps to secure its systems and investigate the nature and scope of the Incident. On or about May 16, 2023, the City discovered that the Incident may have impacted personally identifiable information (“PII”). We have found no evidence that your information was misused.

What Information was Involved

The Incident may have resulted in unauthorized access to or acquisition of certain files that may have contained one or more of the following data elements:

• For current or former employees: name, address, birthdate, social security number, and/or driver’s license number or state ID.
• For users of the City of Tomball Municipal Court: name, address, birthdate, social security number, and/or driver’s license number or state ID.
• For current or former utility customers: name, address, social security number, and/or driver’s license number or state ID.
• For City vendors and/or contractors: name, address, and social security number.

What We Are Doing

As part of its extensive investigation, The City worked diligently to identify files containing PII that may have been subject to unauthorized access or acquisition as a result of the Incident. This process was time-intensive, but ultimately necessary to properly identify potentially affected individuals. 

Out of an abundance of caution, and in accordance with applicable law, we are providing this notice to you so that you can take steps to minimize the risk that your information will be misused.  The attached sheet describes steps you can take to protect your identity, credit, and personal information.  

The City endeavors to protect the privacy and security of sensitive information. We have worked diligently to determine how this incident happened and are taking appropriate measures to prevent a similar situation in the future. Since the Incident we have implemented a series of cybersecurity enhancements, including installation of additional endpoint detection and response software, resetting all passwords, and rebuilding affected servers.

What You Can Do

We recommend that you immediately reset your username and password to all financial accounts, and that you remain vigilant and take the following steps to protect your personal information:

1. Contact the nationwide credit-reporting agencies as soon as possible to:

• Add a fraud alert statement to your credit file at all three national credit-reporting agencies: Equifax, Experian, and TransUnion.  You only need to contact one of the three agencies listed below; your request will be shared with the other two agencies.   This fraud alert will remain on your credit file for 90 days.
• You can also receive information from these agencies about avoiding identity theft, such as by placing a “security freeze” on your credit accounts. 
• Remove your name from mailing lists of pre-approved offers of credit for approximately six months.
• Receive and carefully review a free copy of your credit report by going to www.annualcreditreport.com.

2. Carefully review all bills and credit card statements you receive to see if there are items you did not contract for or purchase. Also review all of your bank account statements frequently for checks, purchases, or deductions not made by you. Note that even if you do not find suspicious activity initially, you should continue to check this information periodically since identity thieves sometimes hold on to stolen personal information before using it. 

3. The Federal Trade Commission (“FTC”) offers consumer assistance and educational materials relating to identity theft, privacy issues, and how to avoid identity theft, such as by setting up fraud alerts or placing a “security freeze” on your credit accounts. The FTC can be contacted either by visiting www.ftc.gov, www.consumer.gov/idtheft, or by calling (877) 438-4338. 

If you suspect or know that you are the victim of identity theft, you should contact local law enforcement, and you can also report this to the Fraud Department of the FTC, which will collect all information and make it available to law enforcement agencies. The FTC can be contacted at the website or phone number above, or at the mailing address below:

Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue NW, Washington, DC 20580 

For More Information

If you have questions or concerns, please contact us at (844) 539-0963.  We apologize for this situation and any inconvenience it may cause you.