P2021-ND-053

The Organization retains a third party service provider, TSGI Corporation (TSGI), to process and analyze tax credits. TSGI advised the Organization that a (now) former employee of TSGI improperly accessed and collected data, some of which contained confidential information about the Organization’s current and former employees. The breach occurred between January 28, 2019 and February 20, 2019. The Organization understands the breach was discovered by TSGI on or about February 25, 2019. The Organization had concluded its contractual arrangement with TSGI prior to the breach; however, TSGI retained the personal information in accordance with the terms of a Mutual Non-Disclosure Agreement and legislative records retention requirements.