Potential data breach could impact some concealed carry permit holders in a Colorado county

CUSTER COUNTY, Colo. (KKTV) - The Custer County sheriff in Colorado is alerting the public to a potential data breach impacting concealed carry permit holders.

A message was shared on social media on Tuesday explaining the concerns, despite no evidence that any type of breach occurred.

The following was posted to the Custer County Sheriff’s Office Facebook page:

Today, Custer County Sheriff, Rich Smith, emailed and/or mailed letters informing all Custer County Concealed Carry Permit (CCP) holders of a potential data breach investigation. Custer County Sheriff’s Office (CCSO) conducted an investigation with the vendor and were unable to find that any beach occurred; however, proper notice is required by Colorado Statute.

Beginning on February 1, 2018, CCSO began issuing concealed carry permits using an ID card and printer system known as the Salamander System. This Salamander System is owned by the State of Colorado and stored personal identifying information (PII) on a central server. Over the next five plus years we entered permit information in the system to print ID cards for 856 permit holders.

A Custer County employee discovered that your PII could possibly be viewed by other users of the system. Nevertheless these users are vetted and subject to the End User License Agreement (EULA)

found at this link. https://www.salamanderlive.com/index.php/eula

The vendor was contacted for clarification. We also reported that we were investigating a potential data breach to the Colorado Attorney General’s Office as required by Colorado Statute.

The vendor reports that only two of their employees had the capability to view our data in addition to public safety officials in Colorado. The vendor is confident that no data breach occurred, and the CCSO is unaware of the misuse of any of PII. Custer County Sheriff Rich Smith authorized emergency funding to create a separate database that is only viewable by the Custer County Sheriff’s Office staff for the purpose of creating new CCP ID cards or renewing expired cards. Your data was moved to this new isolated system last week.

The Salamander system was created to comply with the Colorado First Responder Authentication Credential (COFRAC) requirements. Nearly all law enforcement agencies, fire department, EMS, search

and rescue volunteers, and other emergency responders in Colorado are issued ID cards using the Salamander system. During a disaster, the ID card system can be used as responders report to the incident commander for assignment. The system tracks their training certifications and the hours worked at the disaster to help with billing and accountability.

We are confident that your data has been protected for the past 5 years. As always, be vigilant monitoring your credit report. Be suspicious of emails or text messages from unknown persons seeking personal information. For additional resources regarding identity theft please review these websites:

● https://www.identitytheft.gov/#/

● https://www.justice.gov/.../identity-theft-victim-resources

● https://ovc.ojp.gov/.../pubs/ID_theft/stepsforvictims.htm