Fallon County reviews employee-data breach affecting third-party payroll vendor; asks EVMS to provide draft notices and clarify costs

County staff and legal counsel briefed commissioners on a reported privacy incident linked to a third‑party vendor (EVMS) that provided payroll/benefit services for county employees. County attorneys and outside counsel engaged through the county’s cyber insurance broker participated in a confidential scope conversation to determine options for legal assistance.

Counsel and staff told commissioners they had a limited free consult with the county’s cyber insurer’s recommended attorneys to scope possible legal assistance and that the insurer’s deductible is $25,000. County counsel reported the vendor could provide notification services (state, federal and affected-individual notices) and recommended the county ask the vendor to prepare notices and confirm whether notification and credit‑monitoring services would be provided at no cost. Staff were unable to confirm availability of draft notices before the February 21 deadline and asked for commission direction.

Commissioners directed staff to request from EVMS (or its contracted notice vendor) written confirmation that EVMS will perform required notifications, to ask for draft notices for county review before distribution, and to insist on written confirmation of whether credit monitoring or other remediation will be provided at no cost to affected individuals. Staff said they had submitted an insurance claim but that the county could close the claim if the vendor performs the notices and the county does not retain the outside attorneys. Commissioners asked for verification and copies of notices and filing proof to meet statutory notification deadlines and to retain documentation for regulatory compliance. County legal counsel said the county would seek to avoid paying for outside counsel if the vendor will provide compliant notices in a timely fashion.