August 24, 2020

Patrick H. Haggerty
direct dial: 513.929.3412
[email protected]

VIA E-MAIL ([email protected])

Consumer Protection Division

Security Breach Notifications
Office of the Attorney General of Iowa
1305 E. Walnut Street
Des Moines, IA 50139

Re: Incident Notification

Dear Sir or Madam:

We are writing on behalf of our client, Arbiter Sports, LLC, to notify you of a security
incident involving Iowa residents.1

ArbiterSports recently detected unauthorized access to certain devices in its network and
an attempt to encrypt its systems. ArbiterSports immediately took measures to stop the access,
launched an investigation, and a security firm was engaged. On July 15, 2020, findings from the
investigation identified a backup copy of a database made for business continuity reasons was
obtained by the unauthorized party at some point in the prior few weeks. Although ArbiterSports
was able to prevent devices from being encrypted, the unauthorized party demanded payment in
exchange for deleting the files that were obtained. ArbiterSports reached an agreement and
obtained confirmation that the unauthorized party deleted the files.

The database file involved contained the information of 8,158 Iowa residents, including
account usernames and passwords, names, addresses, email addresses, dates of birth, and Social
Security numbers. The passwords and Social Security numbers were encrypted in the file, but the
unauthorized party was able to decrypt the data.

1
This notice does not waive ArbiterSports’ objection that Iowa lacks personal jurisdiction over it regarding any claims
related to this incident.
August 24, 2020
Page 2

On August 24, 2020, ArbiterSports began mailing notification letters to the Iowa residents
in substantially the same form as the enclosed letter via U.S. First-Class mail in accordance with
Iowa Code § 715C.1-2. ArbiterSports is offering eligible individuals a complimentary, one-year
membership to credit monitoring and identity protection services. ArbiterSports has also
established a dedicated, toll-free call center where individuals may obtain more information
regarding the incident.

To help prevent a similar incident from occurring in the future, ArbiterSports has
implemented additional measures and changes to enhance the security of its network.

Please do not hesitate to contact me if you have any questions regarding this matter.

Sincerely,

Patrick H. Haggerty
Partner

Enclosure

4838-3364-5000.3
 Return Mail Processing
PO Box 589
Claysburg, PA 16625-0589
August 24, 2020

F7214-L01-0000001 P001 T00001 ***********MIXED AADC 159

ALGPBPFPBMHPBNAOHK SAMPLE A SAMPLE - L01 ADULT MASTER CM
AMLIDMPDNPJJHBMMLK
ALCNHOLHNIDEJKBHMK APT 123
AIAGDDGDBMHIFDFJLK
DDDLLLDLLLDLLLDDDL 123 ANY ST
ANYTOWN, US 12345-6789
spsssqrqssqrsrrrqrsqprrrsqsqspspspspqrrsprsppqssqqrqspqqssqsqqqqq

Dear Sample A Sample:

ArbiterSports is committed to protecting the confidentiality of our customers’ information. We are writing to
notify you that we recently identified and addressed a data security incident that involved some of your
information. This notice provides you with a description of the incident, our response, and the steps you may take.

What Happened?
We recently detected unauthorized access to certain devices in our network and an attempt to encrypt our systems.
We immediately took measures to stop the access, launched an investigation, and a security firm was engaged.
On July 15, 2020, findings from the investigation identified a backup copy of a database made for business
continuity reasons that was obtained by the unauthorized party at some point in the prior few weeks. Although we
were able to prevent devices from being encrypted, the unauthorized party demanded payment in exchange for
deleting the files that were obtained. We reached an agreement and obtained confirmation that the unauthorized
party deleted the files.

What Information Was Involved?

The database file involved supports ArbiterGame, ArbiterOne, and ArbiterWorks and contained information about
our users, including account username and password, name, address, date of birth, email address, and Social
Security number. The passwords and Social Security numbers were encrypted in the file, but the unauthorized
party was able to decrypt the data.

What We Are Doing.

We have implemented additional measures and changes to enhance the security of our network. We also notified
law enforcement and are supporting their investigation.

What You Can Do.

We are offering a complimentary one-year membership of Experian’s® IdentityWorksSM Credit 3B. This product
helps detect possible misuse of your personal information and provides identity protection services focused on
identification and resolution of identity theft. IdentityWorksSM Credit 3B is completely free to you and enrolling
in this program will not hurt your credit score. For more information on identity theft prevention and
IdentityWorksSM Credit 3B, including instructions on how to activate the complimentary one-year membership,
please see the additional information provided with this letter.
0000001
ALGPBPFODLGPBPFOELGK
APHMPDOPKOFBHBANBEFK
AKPOLNGPMGILMCCEPLGK
AIFBIMFNHKDDINBOFMIK
ACOCIKEICCGKIGGMMCMK

F7214-L01
If you have not done so since July 14, 2020, please reset your password. For instructions on how to reset your
password please visit: https://www1.arbitersports.com/Shared/SignIn/ResetPassword.aspx. Please choose a
password that is different than you use for other online accounts. If you use the same ArbiterSports username and
password for any other online account, we recommend that you change your password there as well.

For More Information.

We regret that this occurred and apologize to you for any inconvenience. If you have questions, please call (877)
296-5652, Monday through Friday, from 6:00 am – 8:00 pm Pacific Time or Saturday and Sunday, from 8:00 am
– 5:00 pm Pacific Time.

Sincerely,

Kyle Ford
President & CEO

F7214-L01
To help protect your identity, we are offering a complimentary one-year membership of Experian
IdentityWorksSM Credit 3B. This product helps detect possible misuse of your personal information and provides
you with superior identity protection support focused on immediate identification and resolution of identity theft.

Activate IdentityWorks Credit 3B Now in Three Easy Steps

1. ENROLL by: November 12, 2020 (Your code will not work after this date.)
2. VISIT the Experian IdentityWorks website to enroll: https://www.experianidworks.com/3bcredit
3. PROVIDE the Activation Code: ABCDEFGHI

If you have questions about the product, need assistance with identity restoration or would like an alternative to
enrolling in Experian IdentityWorks online, please contact Experian’s customer care team at (877) 296-5652. Be
prepared to provide engagement number DB21965 as proof of eligibility for the identity restoration services by
Experian.

ADDITIONAL DETAILS REGARDING YOUR EXPERIAN IDENTITYWORKS CREDIT 3B

MEMBERSHIP:

A credit card is not required for enrollment in Experian IdentityWorks Credit 3B. You can contact Experian
immediately without needing to enroll in the product regarding any fraud issues. Identity Restoration
specialists are available to help you address credit and non-credit related fraud.

Once you enroll in Experian IdentityWorks, you will have access to the following additional features:

 Experian credit report at signup: See what information is associated with your credit file. Daily credit
reports are available for online members only.*
 Credit Monitoring: Actively monitors Experian, Equifax and Transunion files for indicators of fraud.
 Experian IdentityWorks ExtendCARETM: You receive the same high-level of Identity Restoration
support even after your Experian IdentityWorks membership has expired.
 $1 Million Identity Theft Insurance**: Provides coverage for certain costs and unauthorized electronic
fund transfers.

Activate your membership today at https://www.experianidworks.com/3bcredit

or call (877) 296-5652 to register with the activation code above.

What you can do to protect your information: There are additional actions you can consider taking to reduce
the chances of identity theft or fraud on your account(s). Please refer to www.ExperianIDWorks.com/restoration
for this information. If you have any questions about IdentityWorks, need help understanding something on your
credit report or suspect that an item on your credit report may be fraudulent, please contact Experian’s customer
care team at (877) 296-5652.

* Offline members will be eligible to call for additional reports quarterly after enrolling.

** The Identity Theft Insurance is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant
company. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all
jurisdictions.

0000001
ALGPBPFODLGPBPFOELGK
APHMPDOPKOFAHCELDMFK
AKPOLNGONEKEGJLLJCPK
AMFBJNBHJAPAPLBMLAJK
ACOGACOEKKOGMOCIOCMK

F7214-L01
 ADDITIONAL STEPS YOU CAN TAKE
We remind you it is always advisable to be vigilant for incidents of fraud or identity theft by reviewing your
account statements and free credit reports for any unauthorized activity. You may obtain a copy of your credit
report, free of charge, once every 12 months from each of the three nationwide credit reporting companies. To
order your annual free credit report, please visit www.annualcreditreport.com or call toll free at 1-877-322-8228.
Contact information for the three nationwide credit reporting companies is as follows:

• Equifax, PO Box 740241, Atlanta, GA 30374, www.equifax.com, 1-800-685-1111

• Experian, PO Box 2002, Allen, TX 75013, www.experian.com, 1-888-397-3742
• TransUnion, PO Box 2000, Chester, PA 19016, www.transunion.com, 1-800-916-8800

If you believe you are the victim of identity theft or have reason to believe your personal information has been
misused, you should immediately contact the Federal Trade Commission and/or the Attorney General’s office in
your state. You can obtain information from these sources about steps an individual can take to avoid identity
theft as well as information about fraud alerts and security freezes. You should also contact your local law
enforcement authorities and file a police report. Obtain a copy of the police report in case you are asked to provide
copies to creditors to correct your records. Contact information for the Federal Trade Commission is as follows:

• Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue NW, Washington,
DC 20580, 1-877-IDTHEFT (438-4338), www.ftc.gov/idtheft

Fraud Alerts and Credit or Security Freezes:

Fraud Alerts: There are two types of general fraud alerts you can place on your credit report to put your creditors
on notice that you may be a victim of fraud—an initial alert and an extended alert. You may ask that an initial
fraud alert be placed on your credit report if you suspect you have been, or are about to be, a victim of identity
theft. An initial fraud alert stays on your credit report for one year. You may have an extended alert placed on
your credit report if you have already been a victim of identity theft with the appropriate documentary proof. An
extended fraud alert stays on your credit report for seven years.
To place a fraud alert on your credit reports, contact one of the nationwide credit bureaus. A fraud alert is free.
The credit bureau you contact must tell the other two, and all three will place an alert on their versions of your
report.
For those in the military who want to protect their credit while deployed, an Active Duty Military Fraud Alert
lasts for one year and can be renewed for the length of your deployment. The credit bureaus will also take you off
their marketing lists for pre-screened credit card offers for two years, unless you ask them not to.
Credit or Security Freezes: You have the right to put a credit freeze, also known as a security freeze, on your
credit file, free of charge, which makes it more difficult for identity thieves to open new accounts in your name.
That’s because most creditors need to see your credit report before they approve a new account. If they can’t see
your report, they may not extend the credit.
How do I place a freeze on my credit reports? There is no fee to place or lift a security freeze. Unlike a fraud alert,
you must separately place a security freeze on your credit file at each credit reporting company. For information
and instructions to place a security freeze, contact each of the credit reporting agencies at the addresses below:

• Experian Security Freeze, PO Box 9554, Allen, TX 75013, www.experian.com

• TransUnion Security Freeze, PO Box 2000, Chester, PA 19016, www.transunion.com
• Equifax Security Freeze, PO Box 105788, Atlanta, GA 30348, www.equifax.com

You'll need to supply your name, address, date of birth, Social Security number and other personal information.
After receiving your freeze request, each credit bureau will provide you with a unique PIN (personal identification
number) or password. Keep the PIN or password in a safe place. You will need it if you choose to lift the freeze.

F7214-L01
How do I lift a freeze? A freeze remains in place until you ask the credit bureau to temporarily lift it or remove it
altogether. If the request is made online or by phone, a credit bureau must lift a freeze within one hour. If the
request is made by mail, then the bureau must lift the freeze no later than three business days after getting your
request.
If you opt for a temporary lift because you are applying for credit or a job, and you can find out which credit
bureau the business will contact for your file, you can save some time by lifting the freeze only at that particular
credit bureau. Otherwise, you need to make the request with all three credit bureaus.

Additional information for residents of the following states:

New York: You may contact and obtain information from these state agencies: New York Department of State
Division of Consumer Protection, One Commerce Plaza, 99 Washington Ave., Albany, NY 12231-0001,
518-474-8583 / 1-800-697-1220, http://www.dos.ny.gov/consumerprotection; and New York State Office of the
Attorney General, The Capitol, Albany, NY 12224-0341, 1-800-771-7755, https://ag.ny.gov

North Carolina: You may contact and obtain information from your state attorney general at: North Carolina
Attorney General’s Office, 9001 Mail Service Centre, Raleigh, NC 27699, 1-919-716-6000 / 1-877-566-
7226, www.ncdoj.gov

A Summary of Your Rights Under the Fair Credit Reporting Act: The federal Fair Credit Reporting Act
(FCRA) promotes the accuracy, fairness, and privacy of information in the files of consumer reporting agencies.
There are many types of consumer reporting agencies, including credit bureaus and specialty agencies (such as
agencies that sell information about check writing histories, medical records, and rental history records). Your
major rights under the FCRA are summarized below. For more information, including information about
additional rights, go to www.consumerfinance.gov/learnmore or write to: Consumer Financial Protection Bureau,
1700 G Street N.W., Washington, DC 20552.
• You must be told if information in your file has been used against you.
• You have the right to know what is in your file.
• You have the right to ask for a credit score.
• You have the right to dispute incomplete or inaccurate information.
• Consumer reporting agencies must correct or delete inaccurate, incomplete, or unverifiable information.
• Consumer reporting agencies may not report outdated negative information.
• Access to your file is limited.
• You must give your consent for reports to be provided to employers.
• You may limit “prescreened” offers of credit and insurance you get based on information in your credit
report.
• You have a right to place a “security freeze” on your credit report, which will prohibit a consumer
reporting agency from releasing information in your credit report without your express authorization.
• You may seek damages from violators.
• Identity theft victims and active duty military personnel have additional rights.

0000001
ALGPBPFODLGPBPFPELGK
APHMPDOPKOFBGDGHALFK
AKPOLNGPMBOPLBKANKHK
AIFAIPGMJCOOLJDKDDJK
ACOGMKEEECOOIOCKAKEK

F7214-L01