Investigation ordered into whether program exposed disabled Virginia residents’ info

Virginia News

Gov. Northam "expects a thorough review"

RICHMOND, Va. (WRIC) — The Virginia Department of Behavioral Health and Developmental Services (DBHDS) plans to launch an internal investigation into whether or not the personal information of Individual and Family Support Program (IFSP) applicants was exposed Tuesday, the first day people could submit an application.

The IFSP Program provides support and resources to individuals and families with developmental disabilities. The funding program gives financial assistance to those individuals and families, who typically are on a waiting list for services through one of the state’s developmental disabilities waivers.

Several complaints were sent to 8News claiming that users could access other people’s personal information, including Social Security numbers, while trying to apply. A DBHDS spokesperson told 8News they “are very concerned that these problems led to the exposure of some of the applicants’ information.”

The IFSP Program Funding Portal was eventually taken down as DBHDS said it was addressing the “technical issues” that may have caused the problem. DBHDS confirmed the site was shut down 16 minutes after it went live at 9 a.m.

DBHDS said it plans to inform applicants at least 48 hours before the site is relaunched. As of Wednesday afternoon, the site remains offline.

A Chesterfield mother said she applied Tuesday so the state money could help her pay for communication devices and therapy for her twins, 5-year-olds named Jaxson and Xavier, who have autism and are non-verbal.

“This is very important information for my kids, for myself. I was just thinking about all of the families who were waiting just like I was at 9 a.m. to get access potentially to this funding,” said Ebony Cunningham. “And now you have to worry about is my information out there, who has access to my information, my kids’ information, I mean it’s scary. It’s terrifying.”

Cunningham told 8News after she hit submit on the application, she was sent an ID number in an email. When she put the number in the online funding portal, another person’s personal information came up. The information that was made available included Social Security numbers and home addresses.

“But I hope they figure out something because the breach of information is a real problem, and especially when you think you’re going into a secure site and you think all of your information is going to be kept confidential and now it’s just out in the open,” Cunningham continued. “It’s terrifying and I’m worried for myself and my kids and everybody else whose information is out there.”

Following reports of a potential breach within the program’s online portal, a spokesperson for Gov. Ralph Northam said the governor is expecting “a thorough review.”

“The governor shares the concerns of those potentially impacted by this situation — he has made it clear he expects a thorough review.” 

DBHDS acknowledged concerns that were shared and assured they are working towards a solution in a message to applicants after the outage. On Wednesday, the agency sent another email updating applicants of the funding portal’s status:

DBHDS is continuing to explore the issues with the Individual and Family Support Program (IFSP) Funding Portal. Out of an abundance of caution, the site will continue to be disabled until we are confident that we have identified and addressed the problems.

In addition to identifying the issues that occurred, our internal investigation will determine whose information may have been affected. If we determine that your information may have been affected, we will contact you directly. 

In the coming days, we expect to contact those who submitted an application before the site was disabled to verify that we did receive their application. We will also release information on the Portal’s re-launch to provide families that did not have an opportunity to apply with the information they will need to complete their application.

At this time, you do not need to contact SeniorNavigator, Family to Family, or the volunteer IFSP Regional Councils to request information about the Portal.

DBHDS will communicate all information about the Portal’s re-launch directly to individuals and families via the IFSP list serv.

If you have contacted us about these issues, thank you. Should you have additional questions or concerns, we have established a method to communicate by email at

Again, thank you for your patience as we work to bring the Portal back online.

DBHDS alerts individuals of the program’s “first-come, first-served” method on its site.

“Remember, the IFSP Funding Program provides assistance on a first-come, first-served basis. Early applications are encouraged,” the IFSP Program’s website states.

DBHDS said Wednesday that applications “are reviewed in the order they are received.”

The full statement from DBHDS can be read below:

DBHDS is experiencing issues with the Individual and Family Support Program (IFSP) Funding Portal and is working diligently to address the issues. We are very concerned that these problems led to the exposure of some of the applicants’ information. The site has been temporarily taken down to address the technical issues and DBHDS is determining the extent of the problem. DBHDS has contacted IFSP Families to let them know the site is down and will send additional messages when we are certain the site is working properly. We will contact applicants whose information may have been exposed as soon as possible to discuss next steps. We plan to begin an internal investigation to determine how this happened.

The application process is scheduled to close by 5 p.m. on October 11, 2019.

Maria Reppas, spokeswoman for Dept. of Behavioral Health and Developmental Services

Reppas said that VITA’s Incident Response team is leading the investigation with the Information Technology staff at DBHDS.

This story is developing. Stay with 8News for updates.


Copyright 2020 Nexstar Broadcasting, Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.

StormTracker 8

Trending Stories

Don't Miss

More Don't Miss

Local Events