FAQs
Security Incident October 13, 2020
About the Cybersecurity Incident:
- What happened?
We identified a Cybersecurity Incident (“the Incident”) potentially impacting our services. We have discovered in our preliminary assessment that the incident had led to unauthorized access into an automated testing server (used for QA*) by an unknown person. We acted immediately to stop the intrusion further and we are investigating and assessing the impact of the incident. Until the time the impact is assessed, there will be an immediate suspension to your accounts with Proctortrack, Remotedesk and Verificient Technologies.
*QA-server: this is an additional server used for automated testing of software development.
- What information was taken?
We are in the process of reviewing the impact of the incident that include assessment of unauthorised access as well as suspected cases of data loss, data theft, data alteration, if any, it’s nature, extent & root causes, to prevent recurrence of the incident. Once the assessment exercise is completed, an update in this regard will be published on our website and social media handles.
- What steps should I immediately take? Or What to do next?
In today’s cyberworld and culture, it is always a smart recommendation to update your passwords on your online accounts. On an individual level, we all can be vigilant and be alert to suspicious activity by changing our login credentials, regularly.
- Has any of my information been altered?
We are in the process of assessing the impact of the incident and we will be able to share more information as we complete the impact assessment of the incident.
- Do I have a personal reason to be concerned about my data being compromised, whom should I call to discuss this?
You can contact your Client Service Representative (for Institutions and Organisations).
Students/Test-takers may write to faqs@verificient.com. We will be able to assist you with your enquiry, while keeping this service confidential.
- How can I know my data is safe? OR How we should trust you in future?
At an organisation level, we work closely with Cybersecurity experts to reduce the risk of security and data breaches. We have invested heavily in our IT Security Systems, and that investment has been successful in the sense that it reduced the risk presented by many attackers. On an individual level, we all can be vigilant and be alert to suspicious activity by requiring a password change every 90 days. We have taken numerous steps to review and enhance our cybersecurity systems, upgradation of firewalls and enhanced access control procedures, and we continue to work closely with the internal team and experts to implement long-term security improvements.
- Was information in my email account accessed?
No, so far, there are no reports about unauthorised access to the test-taker’s registered email account with us, however it is advisable to change the password every 90 days for proctortrack or any platform that is used to access Proctortrack.
- Is the issue contained?
Yes, the issue has been contained and at present, we are in the process of assessing the impact as well conducting a thorough security audit and review.
- Why were you not vigilant or prepared beforehand?
We have been working closely with Cyber security experts in this area and conducting our annual and regular internal audits as there is an inherent risk involved with any IT system. We have invested heavily in IT Security, which has reduced the risk presented by many attackers and helped us detect this sophisticated intrusion. We will keep investing in our security even in the future and provide details about the major security updates.
- Do I need to file a police report?
No, there is no need to file a police report.
- I gave multiple tests through Proctortrack. Can someone alter my test?
At present, we are assessing the impact of the incident and we shall be able to provide specific information shortly, as we complete the impact assessment.
- I created an account in Proctortrack through my official email ID. I am apprehensive if my official data will be stolen?
No, there are no reports about unauthorised access to your/subscriber’s registered email account with us, however it is advisable to change the password every 90 days. Please feel free to write back to us in case you noticed any unauthorised access to your registered account.
- What should I do next to continue with Proctortrack?
We will provide updates on a continuous basis and notify when Proctortrack services are resumed.
- When did the company learn of the incident?
We learned of the incident on October 13, 2020 around 3pm EST and acted immediately to stop the intrusion and began a forensic review (internal and process for an external review) and impact assessment.
- Who and how many people are affected?
We are in the process of reviewing the impact of the incident that include assessment of unauthorised access as well as suspected cases of data loss, data theft, data alteration, if any, it’s nature, extent & root causes, to prevent recurrence of the incident. Any incidents reported during the security review, will be immediately notified to the institutions and users. Once the assessment exercise is completed, an update in this regard will be published on our website and social media handles.
- Is this a new cybersecurity incident?
Yes, this is a new incident, We are in the process of investigating the attack and its root cause.
- What is the vulnerability of this situation?
Verificient Technologies has been intensely investigating the scope of intrusion with the assistance of a leading Cybersecurity firm and forensic team to determine what is the level of impact. We continue to work with a team of professionals as part of our investigation procedures and shall update more on this shortly.
- What are you doing to prevent this from happening again?
We are working with a leading Cybersecurity firm & forensic team to conduct an assessment and provide recommendations on steps that can be taken to help prevent this type of incident from happening again. We have taken numerous steps to review and enhance our cybersecurity systems, upgradation of firewalls, and enhanced access control procedures, and we continue to work closely with the internal team and experts to implement long-term security improvements.
- Who is responsible for the attack?
We are not able to attribute this attack to anyone, at the moment. This security incident has been referred to a Cybersecurity firm & forensic team. The core issue for us is the safety of our community and protecting the integrity of our data.
- Why can’t Verificient Technologies delete my records from the systems?
We can surely delete your data related to the subscription, however, as we are yet to complete the impact assessment of the incident, we are not sure if deleting the data would help.
- When can we expect the situation to normalize? Or when can we access our accounts?
We will update on a continuous basis and notify when Proctortrack services are resumed.
- When the incident is addressed, will my profile be intact or do I have to rebuild it?
We will update you on a continuous basis and notify about our services / restoration as necessary.
- Is there any impact on my card/bank details linked to my account?
NO, We do not store any card/bank details for any users as part of the general process.
- Is there a risk of identity theft?
In today’s cyberworld electronic data is vulnerable to theft, misuse and thus, a possibility of identity theft / impersonation cannot be ruled out. However, we are in the process of assessing the impact of the incident and an update in this regard will be published on our website and social media handles.
- What is the compensation for the inconvenience caused?
We deeply regret and apologize for the inconvenience caused. At present, our focus is to assess and normalize the impact of the incident.
- As an institutional customer, what is the impact of the incident from the GDPR / FERPA and applicable data privacy law standpoint?
We are assessing the impact of the incident and will keep the institutions/organisations informed as soon as any data breach is detected. As the assessment exercise will be complete, an update in this regard will be published on our website and social media handles. We have been intensely investigating the scope of intrusion with the assistance of a leading Cybersecurity firm and forensic team to determine what is the level of impact. We continue to work with a team of professionals as part of our investigation procedures and shall update more on this shortly.
