Notice of Data Security Incident

You may place an initial one-year "Fraud Alert" on your credit files, at no charge. A fraud alert tells creditors to contact you personally before they open any new accounts. To place a fraud alert, call any one of the three major credit bureaus at the numbers below. As soon as one credit bureau confirms your fraud alert, they will notify the others.

If you are very concerned about becoming a victim of fraud or identity theft, you may request a "Security Freeze" be placed on your credit file at no cost. A security freeze prohibits, with certain specific exceptions, the consumer reporting agencies from releasing your credit report or any information from it without your express authorization. You may place a security freeze on your credit report by sending a request in writing, by mail, to all three nationwide credit reporting companies.

In order to place the security freeze, you'll need to supply your name, address, date of birth, Social Security number and other personal information. After receiving your freeze request, each credit reporting company will send you a confirmation letter containing a unique PIN or password. Keep the PIN or password in a safe place — you will need it if you choose to lift the freeze.

Under federal law, you are entitled to one free credit report every 12 months from each of the above three major nationwide credit reporting companies. Call 1-877-322-8228 or request your free credit reports online at www.annualcreditreport.com. Once you receive your credit reports, review them for discrepancies. Identify any accounts you did not open or inquiries from creditors that you did not authorize. Verify all information is correct. If you have questions or notice incorrect information, contact the credit reporting company.

We have no evidence that your medical information involved in this incident was or will be used for any unintended purposes. However, the following practices can provide additional safeguards to protect against medical identity theft.

• Only share your health insurance cards with your health care providers and other family members who are covered under your insurance plan or who help you with your medical care.
• Review your "explanation of benefits" statement which you receive from your health insurance company.
• Follow up with your insurance company or care provider for any items you do not recognize. If necessary, ask for copies of medical records from the date of the potential access noted above to the current date.
• Ask your insurance company for a current year-to-date report of all services paid for you as a beneficiary.

Even if you do not find any suspicious activity on your initial credit reports, the Federal Trade Commission (FTC) recommends that you check your credit reports periodically to help spot and address problems quickly.

If you find suspicious activity on your credit reports or have reason to believe your information is being misused, call your local law enforcement agency and file a police report. Be sure to obtain a copy of the report, as many creditors will want it to absolve you of fraudulent debts. You may also file a complaint with the FTC:

• Web: ftc.gov/idtheft
• Phone: 1-877-IDTHEFT (1-877-438-4338)
• Mail: Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580

Your complaint will be added to the FTC's Identity Theft Data Clearinghouse, where it is accessible to law enforcement for their investigations.

You may contact law enforcement or the Iowa Attorney General's Office to report suspected incidents of identity theft: Office of the Attorney General of Iowa, Consumer Protection Division, Hoover State Office Building, 1305 East Walnut Street, Des Moines, IA 50319, iowaattorneygeneral.gov, telephone: 515-281-5164.

You may obtain information about avoiding identity theft from the Maryland Attorney General's Office: Office of the Attorney General of Maryland, Consumer Protection Division, 200 St. Paul Place, Baltimore, MD 21202, marylandattorneygeneral.gov, telephone: 888-743-0023.

Under Massachusetts law, you have the right to obtain a police report in regard to this incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.

You have rights under the federal Fair Credit Reporting Act (FCRA), including the right to know what is in your file, to dispute incomplete or inaccurate information, and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. Learn more at ftc.gov.

Right to obtain a security freeze or submit a declaration of removal. You may place a security freeze on your credit report to help ensure credit is not granted in your name without your knowledge, or submit a declaration of removal to remove information placed in your report as a result of being a victim of identity theft, pursuant to the Fair Credit Reporting and Identity Security Act.

When you place a security freeze, you'll be given a PIN, password, or similar device to use to remove the freeze or temporarily authorize release of your report. To do so, you must contact the consumer reporting agency and provide: (1) your unique PIN/password, (2) proper identification, and (3) information about the party or period of time for release. A consumer reporting agency must comply with a temporary lift request within three business days by mail, or within fifteen minutes if requested electronically or by phone.

A security freeze does not apply where you have an existing account relationship and your report is requested by that creditor or its agents for account review, collection, fraud control, or similar purposes; for insurance rating or underwriting; for certain governmental purposes; or for prescreening under the FCRA. If you are actively seeking new credit, plan ahead — lifting a freeze can take time, and you should contact the agency at least three business days before applying. You have a right to bring a civil action against a consumer reporting agency that violates your rights under the Act. Requests must be sent to each of Equifax, Experian, and TransUnion using the contact information above.

You may obtain information about preventing identity theft from the New York Attorney General's Office: The Capitol, Albany, NY 12224-0341, ag.ny.gov/consumer-frauds-bureau/identity-theft, telephone: 800-771-7755.

You may obtain information about preventing identity theft from the North Carolina Attorney General's Office: Consumer Protection Division, 9001 Mail Service Center, Raleigh, NC 27699-9001, ncdoj.gov, telephone: 877-566-7226 (toll-free within NC) or 919-716-6000.

You may obtain information about preventing identity theft from the Oregon Department of Justice: 1162 Court Street NE, Salem, OR 97301-4096, doj.state.or.us, telephone: 877-877-9392.

You may contact law enforcement, including the Rhode Island Attorney General's Office, to report incidents of identity theft or learn about protecting yourself: 150 South Main Street, Providence, RI 02903, riag.ri.gov, telephone: 401-274-4400.

You have a right to place a security freeze on your credit report pursuant to the Identity Theft Prevention Act of 2006 (Title 6, Chapter 48). Within five business days of your request, you'll be provided a PIN or password to remove the freeze or temporarily authorize release of your report for a specific period. To do so, contact the consumer reporting agency and provide your PIN/password, proper identification, and the relevant time period. Agencies must comply with a temporary-lift request within three business days.

A freeze does not apply where you have an existing account relationship and your report is requested by that creditor, its agents, or affiliates for account review, collection, fraud control, or similar activities. If actively seeking new credit, plan ahead, as lifting a freeze takes time. You have a right to bring a civil action against a consumer reporting agency or user of your report that violates your rights. Requests must go to each of Equifax, Experian, and TransUnion, and may require your full legal name, Social Security number, date of birth, current and prior addresses, proof of identification, and — if applicable — a copy of a related police report.

The number of Rhode Island residents impacted by this incident is being determined.

You may obtain information about preventing identity theft from the Office of the Attorney General for the District of Columbia: 400 6th Street NW, Washington, D.C. 20001, oag.dc.gov/consumer-protection, telephone: 202-442-9828.

You have the right to ask that nationwide consumer reporting agencies place "fraud alerts" in your file to let potential creditors and others know you may be a victim of identity theft, as described above. You also have a right to place a security freeze on your credit report, as described above.