On October 7, 2021, personal information of some applicants for Individual and Family Support Program (IFSP) funding may have been seen by other applicants through the IFSP Funding Portal. DBHDS discovered the breach within minutes after the IFSP Funding Portal was opened to receive applications and immediately took the Portal offline. This incident appears to be similar to an incident that occurred in 2019. DBHDS’ internal team and VITA have been working to simulate and solve the issue since the 2019 incident. Extensive review and testing took place over 17 months prior to this program being put back into service. The program was functioning properly and it was believed the portal was clear to operate as scheduled.
On October 7, 2021, the portal was up for only minutes before it was shut down immediately upon identification of the problem. DBHDS has already started investigating to determine the extent of the issue, including securing expert resources through the VITA partnership to assist with the investigation. Of note, DBHDS will not attempt to repair the Portal again and another solution will be found for future IFSP application processes.
DBHDS contacted any individuals directly who may have had personal information visible to other applicants who were logged into the IFSP Funding Portal. Out of caution, DBHDS offered those individuals free credit monitoring services for up to two years.
In addition, from September 14th to October 4th, IFSP received over 4,000 requests for assistance during the “Save a Draft” period leading up to the opening of the Portal for applications. Given the large number of applications saved and our desire to assist families as quickly as possible, DBHDS approved ALL IFSP applications that were saved as of October 4, 2021. Funds for those families have already been released.
Any additional questions should be directed to IFSPSupport@dbhds.virginia.gov.
Process for Accepting and Approving Applications Annually, IFSP typically distributes approximately $3 million in funds for assistance to individuals on Virginia’s Developmental Disability Waiver Waiting List. From September 14th to October 4th, IFSP received over 4,000 requests for assistance during the Save a Draft period. Given the large number of applications saved and our desire to assist families as quickly as possible, IFSP intends to approve ALL applications that were saved as of 11:59 p.m. on October 4, 2021.
DBHDS currently have all the information needed to expedite and process these requests, and families should check their email for future information explaining the fund issuance. We expect to issue funds before the end of the 2021 calendar year.
Additionally, IFSP staff reached out to individuals who were impacted by the VITA email outage and those receiving eligibility error messages prior to the end of the “Save a Draft” period. IFSP has captured and logged information for people affected in this group who contacted IFSP directly, My Life, My Community, and their local CSB support coordinators and case managers. IFSP staff is working with those in this group to save a draft as they were adversely impacted by outages.
Out of an abundance of caution, the IFSP Portal will not reopen. Our priority is making sure that we fund individuals and families immediately and explore more stable long-term options to support the on-going needs of individuals and families.
Next Steps?
This information is also be available online at My Life, My Community at https://mylifemycommunityvirginia.org
If you saved an application draft by 11:59 p.m. on October 4th, you will receive a confirmation email within the next few weeks. If additional information is needed, it will be included in the email. You do not need to contact IFSP with additional information. All of the information that you provided in your application has been preserved and will be used to issue your assistance. If you contacted My Life, My Community, a case manage/support coordinator, or IFSP regarding outages and errors that occurred before 11:59 p.m. on October 4th, IFSP will contact you via email with additional instructions. The instructions will tell you how to complete the submission process. You do not need to contact IFSP since we are using our records to determine which individuals were impacted. If you did not save a draft application before 11:59 p.m. on October 4th, IFSP is developing a new process to accept requests for assistance. Currently, DBHDS is contracted to create a new portal with a launch date goal of no later than January 1, 2023. Once we are ready to launch, we will provide notice through the IFSP Listserv.
Answers to Common Questions
How do I know if my application was received? I submitted my IFSP application before the site went down and received a confirmation email. Was my application received? IFSP will not confirm the status of submissions as they are likely inaccurate. Given the extent of the site failures, IFSP will rely on the data collected prior to the October 7th incident. This means any application saved before 11:59 p.m. on October 4th will be considered submitted and funded.
I did not have a chance to fill out an application yet. Will the original application submission deadline be extended? Can I create and application or send an email to be considered for funding?
No, you cannot create a draft application at this time. We will not extend the deadlines for this current funding opportunity. We will open a new opportunity in order to give those who do not receive funds in this round a chance to apply again. All information about future funding will be sent via the IFSP listserv.
Was my personal information impacted/compromised? What can I do to protect my personal information? Are you going to offer free credit reporting for those affected?
DBHDS and VITA’s Incident Response team are continuing the internal investigation with Information Technology staff, and their team will directly contact applicants whose information may have been affected. All who were affected will be contacted by postal mail with information about possible identity-theft protection. In the meantime, to report a concern about your information, please email Alvie Edwards at alvie.edwardsiii@dbhds.virginia.gov or Lisa Johnson at lisa.m.johnson@dbhds.virginia.gov.
When will the website be back up and when will I be able to submit my application? I already saved a draft.
The IFSP Portal will not be re-launched.
How are you going to accommodate the families that were trying to submit their application that morning but weren’t able to?
IFSP intends to fund all applicants with a saved draft as of 11:59 p.m. on October 4, 2021.
I never received an email confirmation for my application but I’ve received multiple email confirmations belonging to different applicants, whom I don’t know, along with their personal information. How do I know if my personal information has been shared?
DBHDS and VITA’s Incident Response team are continuing the internal investigation with Information Technology staff. As part of this process, we are determining exactly which individuals had information shared. DBHDS IT-Security will directly contact applicants whose information may have been affected. If you were able to view someone else’s information and did not have your information shared, you will not be contacted since your information was not shared.
I sent you an email or called and gave my name to someone and left a message for the IFSP Staff, stating that I encountered a problem. Is someone going to email or call me back?
Thank you for the information that you shared with us while we managed this incident. Your information has been critical as we work with our partners to investigate.As you can imagine, our staff has received many emails and phone messages from people who had questions or concerns about this outage. At this time, given our decision to fund all saved applications, we will focus our communication sharing on our listserv. You will not receive a personal email responding to a general issue. If you submitted a complaint, it has been logged and will be reviewed.
** IMPORTANT REMINDER **
If you did not save a draft application before 11:59 p.m. on October 4th, IFSP is developing a new process to accept requests for assistance. Currently, DBHDS is contracted to create a new portal with a launch date goal of no later than January 1, 2023. Once we are ready to launch, we will provide notice through the IFSP Listserv.