[BreachExchange] 24K Cremation Society of Pa. customers notified of possible loss of personal information

Destry Winant destry at riskbasedsecurity.com
Fri Mar 29 09:00:34 EDT 2019


The personal information of more than 24,000 clients of the Cremation
Society of Pennsylvania may have been compromised.

While officials do not believe any identities have actually been
stolen, the organization’s corporate headquarters notified 24,168
people about the possible breach and is offering them free identity
protection and credit monitoring services, officials say.

According to a statement released by the company, a UPS package
containing a computer data storage device was sent from a Cremation
Society location to the corporate headquarters.

A letter sent to customers indicates the package was sent on Feb. 12
and delivered two days later, but the device -- containing a database
with names, addresses, telephone numbers and social security numbers
and some email addresses – was missing.

The letter states the package was likely damaged in transit or at a
UPS facility.

According to the statement, the society immediately filed a
lost-article claim with UPS and launched an internal investigation,
which is ongoing. If the device is found, it will be destroyed,
following a UPS policy, according to the Cremation Society of

“While we do not have any reason to believe the contents have been
improperly accessed, acquired or misused, we have decided out of an
abundance of caution to notify approximately 24,168 potentially
impacted individuals in Pennsylvania and other states,” the company
said in a statement. “We have the utmost respect for our client
families and take this incident very seriously.”

There is no word yet on whether or not the device has been found.

More information about the BreachExchange mailing list