Data Security Notice

United Methodist Retirement Homes takes your privacy and security seriously. Effortless Office, our IT cloud-managed service provider, helps maintain our computer information systems by storing information securely, protecting and backing up our systems, and monitoring for security risks and threats.

On July 16, 2024, Effortless Office detected suspicious activity that temporarily disrupted their computer network. At this same time, URHM noted some disruptions to our service and accessibly. Frequently, when a malicious incident like this occurs, the disruption will affect a company’s ability to conduct business. However, due to Effortless Office’s quick response, the security threat was addressed and services for residents were not interrupted.

The following communities were involved in this event:

• Croasdaile Village
• Cypress Glen
• Wesley Pines

Forensic analysis determined that UMRH-retained personal information, including names, addresses, SSNs, and other personally identifiable information of staff and residents may have been affected. The cyberattack was carried out by an international ransomware group, and those affected by the event have been sent notice and offered security services including credit monitoring and identity protection Effortless Office.

The privacy and protection of personal and protected health information is a top priority for Effortless Office, which deeply regrets any inconvenience or concern this incident may cause. They have established a toll-free call center to answer questions about the incident and address related concerns. Call (877) 719-8597. Representatives are available Monday through Friday, 8:00 am to 8:00 pm Eastern Time.

Read the official notice in full below:

Effortless Office Enterprises, LLC. Notifies Individuals of Data Security Incident

Effortless Office Enterprises, LLC. (“Effortless Office”) learned of a data security incident that may have involved personal and/or protected health information of certain employees and patients of The United Methodist Retirement Homes, Inc. (“UMRH”). Effortless Office has sent notice of this incident on behalf of UMRH to certain effected current/former employees, residents and/or associated parties and provided resources to assist them.

On July 16, 2024, Effortless Office discovered suspicious activity temporarily disrupted the operability of its computer network. Effortless Office promptly took steps to secure the environment and began an investigation to determine the nature and scope of the issue. In addition, Effortless Office began working to restore impacted systems as quickly as possible. Effortless Office engaged digital forensics specialists to conduct an investigation into what happened and determine whether personal information was accessed or acquired without authorization. After determining that personal information may have been impacted, Effortless Office completed a comprehensive programmatic and manual review to identify what personal information was impacted and to whom it belonged. On November 6, 2024, UMRH learned that personal information related to certain current/former employees, residents and/or associated parties was impacted in connection with the incident.

Based on Effortless Office’s review, the following information may have been affected as a result of the incident: names, dates of birth, health insurance information, provider information, treatment and/or diagnosis information, treatment dates, lab or test results, patient account and/or medical record numbers, Medicare/Medicaid information, driver’s license or state identification card numbers, and/or Social Security numbers. Effortless Office began notifying individuals of this incident on December 20, 2024.

Effortless Office has established a toll-free call center to answer questions about the incident and address related concerns. Call center representatives are available Monday through Friday from 8:00 am to 8:00 pm Eastern Time, and can be reached at (877) 719-8597.

The privacy and protection of personal and protected health information is a top priority for Effortless Office, which deeply regrets any inconvenience or concern this incident may cause.

We are providing the following information to help those wanting to know more about steps they can take to protect themselves and their information:

Review Your Account Statements and Notify Law Enforcement of Suspicious Activity: As a precautionary measure, we recommend that you remain vigilant by reviewing your account statements and credit reports closely. If you detect any suspicious activity on an account, you should promptly notify the financial institution or company with which the account is maintained. You also should promptly report any fraudulent activity or any suspected incidence of identity theft to proper law enforcement authorities, your state attorney general, and/or the Federal Trade Commission (FTC).

Copy of Credit Report: You may obtain a free copy of your credit report from each of the three major credit reporting agencies once every 12 months by visiting http://www.annualcreditreport.com/, calling toll-free 1-877-322-8228, or by completing an Annual Credit Report Request Form and mailing it to Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348. You also can contact one of the following three national credit reporting agencies:

• Equifax, P.O. Box 105851, Atlanta, GA 30348, 1-800-525-6285, www.equifax.com.
• Experian, P.O. Box 9532, Allen, TX 75013, 1-888-397-3742, www.experian.com.
• TransUnion, P.O. Box 2000, Chester, PA 19016, 1-800-916-8800, www.transunion.com.

Fraud Alert: You may want to consider placing a fraud alert on your credit report. An initial fraud alert is free and will stay on your credit file for at least one year. The alert informs creditors of possible fraudulent

activity within your report and requests that the creditor contact you prior to establishing any accounts in your name. To place a fraud alert on your credit report, contact any of the three credit reporting agencies identified above. Additional information is available at http://www.annualcreditreport.com.

Security Freeze: You have the right to put a security freeze on your credit file for up to one year at no cost. This will prevent new credit from being opened in your name without the use of a PIN number that is issued to you when you initiate the freeze. A security freeze is designed to prevent potential creditors from accessing your credit report without your consent. As a result, using a security freeze may interfere with or delay your ability to obtain credit. You must separately place a security freeze on your credit file with each credit reporting agency. In order to place a security freeze, you may be required to provide the consumer reporting agency with information that identifies you including your full name, Social Security number, date of birth, current and previous addresses, a copy of your state-issued identification card, and a recent utility bill, bank statement or insurance statement.

Additional Free Resources: You can obtain information from the consumer reporting agencies, the FTC, or from your respective state Attorney General about fraud alerts, security freezes, and steps you can take toward preventing identity theft. You may report suspected identity theft to local law enforcement, including to the FTC or to the Attorney General in your state.

Additional information for residents of the following states:

You also have certain rights under the Fair Credit Reporting Act (FCRA): These rights include to know what is in your file; to dispute incomplete or inaccurate information; to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information; as well as other rights. For more information about the FCRA, and your rights pursuant to the FCRA, please visit https://www.consumer.ftc.gov/sites/default/files/articles/pdf/pdf-0096-fair-credit-reporting-act.pdf.