A security breach occurred at a company called Technology Management Resources. TMR is a vendor of Mascoma Bank, which is a bank used by the City to manage its financial accounts. Mascoma Bank uses TMR to covert data about checks written to the City into the format that the City uses in its financial accounting software. According to Mascoma Bank and TMR, the breach involved an unauthorized individual gaining access to a TMR database that contains the images, or pictures, of scanned checks that were written to the City.

No. The City was not breached or hacked. The breach occurred at a company called Technology Management Resources. The City has notified individuals and organizations potentially affected by the TMR breach because the information affected by the breach includes electronic images of checks written to the City. TMR had the check images because it provides data processing services to Mascoma Bank.

According to Mascoma Bank and TMR, the breach occurred in June 2020. The City first learned about the breach in late August. Since then, the City has been working to identify the individuals and organizations affected, to secure appropriate identity and credit protection services for them, and to notify all affected individuals and organizations.

If an individual or organization received a letter addressed to the individual or organization from the City notifying the individual or organization about this incident, then that individual’s or organization’s information was involved in the TMR breach. If an individual or organization has not received such a letter, then that individual’s or organization’s information was not involved in the breach.

The City notified both all individuals and all organizations potentially affected by the breach. If an individual received a letter addressed to him or her individually, as well as a letter addressed to the individual’s organization, then information for both was affected. That could mean that both the individual’s name and his or her organization’s name was on the same check for the same bank or financial account. It also could mean that the individual and his or her organization wrote two or more checks to the City from different accounts.

If an individual was affected personally, the individual would have received a letter addressed to the individual personally, separate from any letter that might have been sent to the individual’s organization. If the individual’s organization was affected, the organization would have received a letter addressed to it specifically, separate from any letter that might have been sent to an individual personally.

The information affected was a database that contains scanned images of checks written to the City. Those images included the routing number for the individual’s or organization’s bank and the number for the checking account. That information could be used to attempt to withdraw or transfer funds from the individual’s or organization’s account. That is why the City is encouraging all potentially affected individuals and organizations to take certain protective measures. In addition, the images of checks would have included any other information on the check, such as the individual’s or organization’s signature, name, address, and phone number, the number of the check, the amount of the check, any information that was put on the memo line or on any other part of the check, an example of handwriting, and any other information that exists or that was put on the check.

The TMR breach did involve personally identifiable information or PII with respect to individuals, because it included the routing and account numbers on the individual’s check.

TMR is a technology service provider to the financial services industry, including banks. In this case, Mascoma Bank retained TMR to covert data about checks written to the City into the format that the City uses in it financial accounting software.

Mascoma Bank is one of the banks the City uses to maintain its financial accounts. Mascoma Bank is involved because it retained TMR to covert data about checks written to the City into the format the City uses in it financial accounting software.

Banks, like Mascoma Bank, often collect, scan, and deposit checks, but sometimes are unable to provide data about those checks in a format that can be imported into the software used by their customers, like the City. As a result, Mascoma Bank retained TMR, as a technology services provider, to convert data about checks written to the City into the format the City uses in its financial accounting software.

No. The check that you sent to the City was not stolen, and the City received those funds. Only the information that was contained on the check was affected. However, that information included the routing and account numbers on the check, and those numbers could be used to attempt to withdraw or transfer funds from the account. That is why the City is encouraging all potentially affected individuals and organizations to take certain protective measures.

The City has been assured by Mascoma Bank and TMR that they have taken steps to ensure that this type of breach will not reoccur. However, if you would prefer, you can either mail or drop-off your checks directly to City Hall at 3 Washington Street, Keene, New Hampshire 03431. Checks that are dropped off or mailed directly to the City at that address will be handled by the City, and will not go to the lockbox managed by Mascoma Bank.

The City is encouraging all potentially affected individuals and organizations to take three steps to protect themselves. First, enroll in the two-year protective services that are being provided, free of charge. Second, contact the bank or financial institution that the check was written from to alert it about this breach. And third, review the activity in that bank or financial account now and at least monthly thereafter, and immediately notify the bank or financial institution if any fraud is suspected or has occurred.

The protective services offered are from Experian. To enroll, an individual should go to the website www.experianidworks.com/credit, and an organization should go to the website www.protectmybusinessid.com. Once at the website, the individual or organization should use the code provided in the letter addressed to the individual or organization. If an individual or organization has questions, he, she, or it can contact Experian at 866-578-5413. Individuals and organizations have until January 31, 2021 to enroll, so he, she, or it will need to enroll by that date to take advantage of these services.

The protection services includes a variety of different features. Individuals received a credit report from Experian, monitoring by Experian of the individual’s credit file, up to $1 million of identity theft insurance, and identity restoration agents who are available to help individuals address identity, credit and financial fraud. Organization receive a business credit report from Experian, and alerts of key changes to the organization’s report indicating potential fraud. If an individual or organization has questions about these protective services, the individual or organization should contact Experian at 866-578-5413. Individuals and organizations have until January 31, 2021 to enroll, so he, she, or it will need to enroll by that date to take advantage of these services.

An individual or organization should tell the bank or financial institution that a scanned image of the check was involved in a breach, including the routing and account numbers on the check. The individual or organization should ask the bank or financial institution if it can provide any protections for the account to detect or prevent fraud.

An individual or organization should consult with the bank or financial institution about whether to change the number of the account. That is a decision that only the individual or organization can make in consultation with fraud specialists at the bank or financial institution.

An individual or organization should review the bank or financial accounts now to determine if any withdrawals or deposits have been made that the individual or organization did not authorize or does not recognize. If so, the individual or organization should immediately notify the bank or financial institution about the potential that the transaction may be fraudulent. In addition, the individual or organization should review the bank or financial account at least monthly to ensure that the individual or organization authorized or recognizes all withdrawals and deposits into or out of that account.

The TMR breach did not involve Social Security Numbers or other governmental identification numbers. As a result, the City believes that potentially affected individual’s identities are not at any increased risk as a result of the TMR breach.

The City is encouraging potentially affected individuals and organizations to take three steps: (1) enroll in the protectives services that are being provided, free of charge; (2) contact the bank or financial institution to alert it about this breach; and (3) review the activity in the bank or financial account now and at least monthly thereafter, and immediately notify the bank or financial institution if any fraud is suspected or has occurred. While the City is not encouraging individuals or organizations to take any other steps, if an individual or organization chooses to do so, the individual or organization could do two additional things. First, an individual or organization could obtain his, her, or its credit reports, inspect them for any potentially fraudulent activity, and notify the creditor of fraudulent activity. Second, an individual or organization could either implement a 90-day fraud alert, or freeze/lock his, her, or its credit files. For individuals, such services are provided by all three of the major credit bureaus, as follows: Equifax’s – 866-349-5191 and www.equifax.com; Experian – 888-397-3742 and www.experian.com; TransUnion – 800-888-4213 and www.transunion.com. For organizations, only Experian and Equifax provide fraud alert/freeze/lock function.

Experian mailed the letters to all potentially affected individuals and organizations. The Pennsylvania return address is used by Experian to track letters returned as undeliverable. The letter is legitimate, originated from the City, and is on the City’s letterhead.

If an individual or organization would like to speak with someone at the City about the TMR breach, the individual or organization should send an email to inquiries@ci.keene.nh.us that includes his, her, or its contact information, and a person from the City will contact the individual or organization.