American Friends Service Committee

• •Took steps to stop the employee’s access
• •Terminated the employee
• •Contacted law enforcement
• •Began notifying employees about the incident
• •Provided additional information and updates
• •Made credit monitoring services available to the employees for 5 years at no cost
• •Coordination with an external IT security consultant and law enforcement

• •Reviewing its policies and procedures to make sure employees are more aware of their responsibilities for handling employee personal information
• •Additional training
• •Assess and modify our privacy and data security policies and procedures
• •Reviewing our systems and making improvements where we can to minimize the chances of this happening again
• •Training all staff concerning acceptable access, use and disclosure of personal information maintained by the organization

DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).