ibex Provides Notice of Data Security Incident

ibex today issued this announcement concerning an earlier event, disclosed by the company on October 23, 2020 in its Annual Report (Form 20-F), which may have potentially impacted the security of information relating to certain employees and their families. While ibex is unaware of any attempted or actual misuse of personal information in relation to the event, ibex provided potentially affected individuals with notice, information about the event and steps individuals can take to help protect their information.

On August 17, 2020, ibex learned that it was the victim of a malware attack that impacted the availability of a limited segment of our systems. We immediately took these systems offline and, with the assistance of third-party computer specialists, launched an investigation to determine the nature and scope of the incident. On or about September 15, 2020, the investigation confirmed that certain files on our systems may have been accessed without authorization between July 27 and August 17, 2020. We therefore undertook a meticulous and time-intensive review of the potentially impacted files and our internal systems in order to identify the information that was involved and to whom it related. In connection with this review, on or about September 29, 2020, a third-party firm was engaged to review the potentially impacted files. ibex, upon receiving and validating the findings of the third-party firm, on or about June 14, 2021, determined that one or more of the potentially impacted folders included information related to individuals.

In conjunction and collaboration with the third-party review team, ibex continued to diligently review and reconcile the information with internal and public records in furtherance of identifying the individuals to whom the data relates and the appropriate contact information for those individuals. These efforts were completed on or around July 11, 2021, at which time ibex determined the scope of impacted individuals and the types of protected data associated with those individuals.

We thereafter worked to provide notification to potentially impacted individuals as quickly as possible. Importantly, there is no indication that any person’s specific information was accessed or misused. However, ibex is notifying potentially impacted individuals out of an abundance of caution.

Information security is important to us, and we have strict security measures in place to protect information in our care. Upon discovering this incident, we immediately took steps to review and reinforce the security of our systems. We have implemented additional cybersecurity measures to further protect against similar incidents moving forward. Additionally, ibex is providing potentially impacted individuals with complimentary access to identity monitoring, fraud consultation, and identity theft restoration services.

ibex encourages individuals to monitor their accounts and activate the complimentary credit monitoring and identity protection services being offered. Please see the section below for more information. Individuals may call ibex’s call center at 866-871-8614 (toll free), Monday through Friday from 9 am to 9 pm Eastern Time. Potentially affected individuals may also consider the information and resources outlined below.

Steps You Can Take to Protect Personal Information

Monitor Accounts

Under U.S. law, a consumer is entitled to one free credit report annually from each of the three major credit reporting bureaus, Equifax, Experian, and TransUnion. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also directly contact the three major credit reporting bureaus listed below to request a free copy of your credit report.

Consumers have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a 1-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any one of the three major credit reporting bureaus listed below.

As an alternative to a fraud alert, consumers have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without the consumer’s express authorization. The credit freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a credit freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a credit freeze on your credit report. To request a security freeze, you will need to provide the following information:

1. Full name (including middle initial as well as Jr., Sr., II, III, etc.);
2. Social Security number;
3. Date of birth;
4. Addresses for the prior two to five years;
5. Proof of current address, such as a current utility bill or telephone bill;
6. A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.); and
7. A copy of either the police report, investigative report, or complaint to a law enforcement agency concerning identity theft if you are a victim of identity theft.

Should you wish to place a fraud alert or credit freeze, please contact the three major credit reporting bureaus listed below:

Additional Information

You may further educate yourself regarding identity theft, fraud alerts, credit freezes, and the steps you can take to protect your personal information by contacting the consumer reporting bureaus, the Federal Trade Commission, or your state Attorney General. The Federal Trade Commission may be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); and TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. You have the right to file a police report if you ever experience identity theft or fraud. Please note that in order to file a report with law enforcement for identity theft, you will likely need to provide some proof that you have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement and your state Attorney General. This notice has not been delayed by law enforcement.

Media and Investor Contact:
Brad Jones
ibex
720-643-8731
brad.jones@ibex.co