Ellington Management Group (“Ellington” or “we”) recently experienced a data incident (“Incident”) which potentially involved certain individuals’ personal information (“Information”). This notice provides information about this Incident, our response, and information on where to direct questions. Additionally, although we are unaware of any misuse of any affected individuals’ Information or fraud in relation to the Incident, as a precaution we have also provided steps affected individuals can take to protect their Information.
On August 8, 2023, Ellington detected suspicious activity within one of its email accounts. Ellington immediately took steps to address the situation and mitigate risk to its data, including changing passwords, notifying federal law enforcement, and engaging leading cybersecurity professionals for assistance.
Our investigation determined that between July 18, 2023 and August 8, 2023 an unauthorized actor had access to a single Ellington email account for the demonstrated purpose of sending phishing emails. We analyzed the email account and did not find any evidence of any data being downloaded, emails being forwarded, or the account being synced to other systems. Out of an abundance of caution, we analyzed all of the data in the email account to identify if any personal information was present so we could notify individuals as appropriate. There is currently no evidence that any information has been misused for identity theft or fraud in connection with the incident.
We can confirm that the email account did not include any personal information related to Ellington’s clients or investors. We determined that the following general categories of information may have been involved in the incident but are not relevant to every individual impacted: name, date of birth, Social Security number, medical information, and driver’s license number. In only three instances, non-Ellington financial account information may have been impacted.
Upon becoming aware of the incident, we worked with leading data privacy and security professionals to aid in our response and report this incident to relevant government agencies, federal law enforcement, and affected individuals. We also implemented additional security protocols designed to protect and improve our network, email environment, and systems, and are currently assessing the entirety of our information security program.
We encourage potentially-affected individuals to remain vigilant against incidents of identity theft and fraud by reviewing their account statements and monitoring their free credit reports for suspicious activity and to detect errors.
Potentially-affected individuals can also enroll in the credit monitoring services that we are offering at no cost. To help relieve concerns and restore confidence following this event, we have secured the services of Kroll to provide identity monitoring. Kroll is a global leader in risk mitigation and response, and the Kroll team has extensive experience helping people who have sustained an unintentional exposure of confidential data. Kroll’s identity monitoring services include Credit Monitoring, Fraud Consultation, and Identity Theft Restoration.
Potentially-affected individuals seeking additional information, including information about whether their Information was involved and their eligibility for complimentary credit monitoring, may call our toll-free assistance line at (866) 983-4820 Monday through Friday from 9:00 am to 6:30 pm Eastern time (excluding U.S. holidays).
Please review the “Steps You CanTake to Protect Your Personal Information” section included with this letter, which outlines other resources individuals can utilize to protect their Information.
Again, potentially affected individuals seeking additional information, including information about the availability of complimentary credit monitoring, may call our toll-free assistance line at (866) 983-4820 Monday through Friday from 9:00 am to 6:30 pm Eastern time (excluding U.S. holidays).
Contact information for the three nationwide credit reporting agencies:
Equifax, PO Box 740241, Atlanta, GA30374, www.equifax.com, 1-800-685-1111
Experian, PO Box 2104, Allen, TX 75013, www.experian.com, 1-888-397-3742
TransUnion, PO Box 2000, Chester, PA19022, www.transunion.com, 1-800-888-4213
Free Credit Report. It is recommended that you remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring your credit report for unauthorized activity. You may obtain a copy of your credit report, free of charge, once every twelve (12) months from each of the three nationwide credit reporting agencies.
To order your annual free credit report please visit www.annualcreditreport.com or call toll free at 1-877-322-8228.
You can also order your annual free credit report by mailing a completed Annual Credit Report Request Form (available from the U.S. Federal Trade Commission’s (“FTC”) website at www.consumer.ftc.gov) to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.
Fraud Alert. You may place a fraud alert in your file by calling one of the three nationwide credit reporting agencies above. A fraud alert tells creditors to follow certain procedures, including contacting you before they open any new accounts or change your existing accounts. For that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit.
Security Freeze. Pursuant to 15 U.S.C. § 1681c-1, you may obtain a security freeze on your credit report, free of charge, to protect your privacy and ensure that credit is not granted in your name without your knowledge. You may also submit a declaration of removal to remove information placed in your credit report as a result of being a victim of identity theft. You have a right to place a security freeze on your credit report, free of charge, or submit a declaration of removal pursuant to the Fair Credit Reporting and Identity Security Act.
The security freeze will prohibit a consumer reporting agency from releasing any information in your credit report without your express authorization or approval. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. When you place a security freeze on your credit report, you will be provided with a personal identification number, password, or similar device to use if you choose to remove the freeze on your credit report or to temporarily authorize the release of your credit report to a specific party or parties or for a specific period of time after the freeze is in place.
To place a security freeze on your credit report, you may be able to use an online process, an automated telephone line, or a written request to any of the three credit reporting agencies listed above. The following information must be included when requesting a security freeze (note that if you are requesting a credit report for your spouse, this information must be provided for him/her as well): (1) full name, with middle initial and any suffixes; (2) Social Security number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any applicable incident report or complaint with a law enforcement agency or the Registry of Motor Vehicles. The request must also include a copy of a government-issued identification card and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be legible, and display your name, current mailing address, and the date of issue.
Federal Trade Commission and State Attorneys General Offices. If you believe you are the victim of identity theft or have reason to believe your personal information has been misused, you should immediately contact the Federal Trade Commission and/or the Attorney General’s office in your home state. You may also contact these agencies for information on how to prevent or avoid identity theft.
You may contact the Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580, www.ftc.gov/, 1-877-IDTHEFT (438-4338).
For California and Wyoming Residents: This notification was not delayed as a result of any law enforcement investigation.
For Colorado Residents: You can obtain information from the federal trade commission and the credit reporting agencies about fraud alerts and security freezes.
For Illinois Residents: You can obtain information from the credit reporting agencies and the Federal Trade Commission about fraud alerts and security freezes (contact information above).
For Iowa Residents: You are advised to report suspected incidents of identity theft to your local law enforcement or the Iowa Office of the Attorney General, 1305 E. Walnut Street, Des Moines IA 50319, firstname.lastname@example.org, 1-888-777-4590.
For Maryland Residents: You may obtain information about steps you can take to avoid identity theft from the Federal Trade Commission (contact information above) and the Maryland Office of the Attorney General, Consumer Protection Division, 200 St. Paul Place, Baltimore, MD 21202, www.oag.state.md.us, 1-888-743-0023.
For New Mexico Residents: Consumers have rights pursuant to the Fair Credit Reporting Act, such as the right to be told if information in their credit file has been used against them, the right to know what is in their credit file, the right to ask for their credit score, and the right to dispute incomplete or inaccurate information. Further, pursuant to the Fair Credit Reporting Act, the consumer reporting bureaus must correct or delete inaccurate, incomplete, or unverifiable information; consumer reporting agencies may not report outdated negative information; access to consumers’ files is limited; consumers must give consent for credit reports to be provided to employers; consumers may limit “prescreened” offers of credit and insurance based on information in their credit report; and consumers may seek damages from violators. Consumers may have additional rights under the Fair Credit Reporting Act not summarized here. Identity theft victims and active-duty military personnel have specific additional rights pursuant to the Fair Credit Reporting Act. We encourage consumers to review their rights pursuant to the Fair Credit Reporting Act by visiting www.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf, or by writing Consumer Response Center, Room 130-A, Federal Trade Commission, 600 Pennsylvania Ave. N.W., Washington, D.C. 20580.
For New York Residents: You may obtain information regarding security breach response and identity theft prevention and protection information from the Federal Trade Commission (contact information above) and the New York Office of the Attorney General, Office of the Attorney General, The Capitol, Albany, NY 12224-0341, https://ag.ny.gov, 1-800-771-7755.
For North Carolina Residents: You may obtain information about preventing identity theft from the Federal Trade Commission (contact information above) and the North Carolina Office of the Attorney General, Consumer Protection Division, 9001 Main Service Center, Raleigh, NC 27699-9001, www.ncdoj.gov, 1-877-566-7266.
For Oregon Residents: You are advised to report any suspected identity theft to law enforcement, the Federal Trade Commission, and the Oregon Office of the Attorney General, 1162 Court Street NE, Salem, OR 97301, https://www.doj.state.or.us/, (503) 378-6002.
For Rhode Island Residents: You have the right to file or obtain any police report in regard to this incident.