Breach in ASN's Data: Frequently Asked Questions
What happened?
On March 15, 2021, ASN was notified by a vendor that has provided conference registration services to ASN that its system had been compromised by cybercriminals. The vendor reported that the cybercriminals used malware to encrypt certain of the vendor's systems. As a result of the attack, a subset of information from ASN's database that was held in the vendor's system may have been exposed and obtained by the cybercriminals.
Why was ASN sharing data with this vendor?
The vendor in question provided conference registration services for ASN. Sharing data was necessary for the registration service to operate.
What information of mine was exposed?
We do not know what specific information was exposed for any individual. Data that were potentially exposed were name, address, email address, phone number, fax number, date of birth, job function, National Provider Identifier (NPI) Number, National Association of Boards of Pharmacy (NABP) Number, and ASNID Number.
What about Social Security Numbers (SSN)?
Neither ASN nor the vendor collects nor stores SSNs, so to our knowledge this type of information was not exposed.
What about credit card numbers?
Credit cards numbers used in online event registration were not stored on the vendor system, and were therefore not exposed to our knowledge.
Do I need to change my ASN password?
Passwords were not held in the vendor's system, and were therefore not exposed. If you would like to change your password, you can do so here.
What is ASN doing to protect my data?
ASN is actively working with the vendor to obtain a full forensic analysis of the incident. We will take every step necessary to prevent this type of situation from happening again.
We have created a dedicated email account (support@asn-online.org) where you can direct your questions and concerns, and this FAQ page (https://www.asn-online.org/support) to provide updated information as we learn it.
In addition, ASN has initiated a full security review of all ASN vendors. As part of that effort, we will work with outside consultants to identify potential security gaps and ensure compliance with industry data security practices.
What can I do to protect my own data?
To our knowledge, no financial information, passwords, or social security numbers were compromised. Thus, this incident should not require active monitoring of your credit report. However, it is possible that your contact information may be distributed to others who try to use it illegally. For example, cybercriminals could attempt to defraud you by contacting you via email or phone, and claim to have control of your online accounts.
You should use caution when deciding whether to respond to any correspondence that you do not recognize. If you think that your information has been used in an attempt to steal your identity, please visit https://identitytheft.gov, which offers resources to report identity theft and develop a recovery plan.
Who can I contact for more information?
ASN has established a dedicated email address to help respond to this situation. If you have any questions or concerns, or would like to speak directly with an ASN representative, please contact support@asn-online.org.