Agenda

Return

C. 48

To:	Board of Supervisors
From:	Karen Caoile, Director of Risk Management
Date:	February 8, 2022

Contra

Costa

County

Subject:

Contract with Epiq Class Action & Claims Solutions, Inc.

APPROVE	OTHER
RECOMMENDATION OF CNTY ADMINISTRATOR	RECOMMENDATION OF BOARD COMMITTEE

Action of Board On: 02/08/2022

APPROVED AS RECOMMENDED

OTHER

Clerks Notes:

VOTE OF SUPERVISORS

AYE:

John Gioia, District I Supervisor
Candace Andersen, District II Supervisor
Diane Burgis, District III Supervisor
Karen Mitchoff, District IV Supervisor
Federal D. Glover, District V Supervisor

Contact:

Karen Caoile 925-335-1400

I hereby certify that this is a true and correct copy of an action taken and entered on the minutes of the Board of Supervisors on the date shown.
ATTESTED: February 8, 2022
Monica Nino, County Administrator

BY:	, Deputy

RECOMMENDATION(S):

APPROVE and AUTHORIZE the Director of Risk Management's execution of a contract with Epiq Class Action & Claims Solutions, Inc. for the period from February 1, 2022 through January 31, 2023, for cyber-breach notification services in an amount not to exceed $100,000.

FISCAL IMPACT:

Costs are paid through the County's ISF Public Liability Program.

BACKGROUND:

At various times between June 24, 2021 and August 12, 2021, email accounts of various employees at Employment and Human Services and Human Resources were accessed by an unauthorized source. It is unknown whether any emails or attachments in the accounts were accessed or downloaded by the unauthorized source.

BACKGROUND: (CONT'D)

The County's Cyber Insurance carrier was contacted and the carrier's cyber-security response team recommended entering into the agreement with Epiq. Under the terms of the agreement, Epiq will research whether the addresses of persons whose personal information might have been disclosed and who do not have addresses on file with the County. Epiq will also mail legally required notices to potentially affected individuals, which will contain information about the potential breach as well as steps to take to safeguard their financial accounts and credit reports.

The agreement limits Epiq's liability to the County for damages under the agreement. It also requires the County to pay staff costs for any testimony and records related to the agreement that are subsequently sought by the County or third-party.

CONSEQUENCE OF NEGATIVE ACTION:

Failure to ratify the agreement could slow the expeditious notification of those whose information may have been compromised by a cyber-breach of Employment and Human Services and Human Resource's email system.