Town of Deerfield

Deerfield, Michigan, operating as the Town of Deerfield, is a municipal entity in the United States responsible for local administration and the management of resident information. Its core operational activity involves the collection, storage, and protection of personal data for community members, which is essential for delivering civic services and maintaining regulatory compliance. The town's scope is defined by its municipal boundaries, serving the residents within its jurisdiction. Data management is a critical function, as evidenced by its reliance on external providers like Springbrook Software for secure data storage. This relationship highlights the town's approach to outsourcing key infrastructure while retaining responsibility for data security. The handling of sensitive information, including identification details, is central to its administrative processes, requiring adherence to privacy standards and incident response protocols.

In March 2021, Deerfield suffered a data breach that exposed the personal information of over 8,100 residents. The incident resulted from unauthorized access to systems operated by Springbrook Software, the town's designated data storage vendor. Compromised data potentially included driver's license or state identification card numbers, leading the town to provide credit monitoring services to affected individuals. The breach response was delayed due to the time required for external investigations and the preparation of resident notification letters following Springbrook's initial alert. Additionally, the town's external counsel incorrectly classified the incident as a healthcare organization breach in regulatory filings, although no health plan data was found to be compromised. This error points to shortcomings in the town's incident classification and regulatory reporting procedures. The event underscores Deerfield's dependence on third-party vendors for critical data management and the associated risks of such arrangements. It also illustrates the challenges municipal governments face in promptly and accurately reporting cybersecurity incidents. The breach serves as a key example of the town's data security vulnerabilities and its subsequent efforts to mitigate harm through credit monitoring offerings.