Resident questions timing of Golf Manor data‑breach notice, urges cybersecurity oversight

Lou Marks, introduced by the mayor as a former council member, told the Golf Manor Village Council on April 21 that he received a March 30 letter from a company named Kroll notifying him his personal information was affected by an earlier breach. "So my concern is 4 and a half months after the data breach, we're just finding out our personal data's gone," Marks said, noting the breach was discovered in November and that Kroll itself experienced a security incident in 2024.

Marks said the late notice — and the fact his name was misspelled on the letter — raised questions about whether the vendor and the village handled the incident properly. "If this was really serious and they're doing their job... how do they misspell my name?" he asked the council.

Mayor (speaker 1) said the vendor was engaged at the direction of the village's insurance company and that the fiscal officer would confirm details. "This was a company that our insurance company, village insurance company, directed us to use," the mayor said, and the council agreed to investigate further and consider inviting a representative to answer resident questions.

Marks urged the council to consider adding cybersecurity and computer-systems oversight to the responsibilities of the executive committee, saying infrastructure security is a fit for that body. Council members acknowledged they rely on the insurance company's recommendation for vendor selection and said they will review the matter with the fiscal officer and solicitor.

The exchange did not include a formal vote or a staff presentation; councilors asked staff to follow up with more information and to consider having a vendor or expert attend a future meeting to answer questions about what data were affected and how residents should be notified or protected.