CHS Inc. Data Breach Notification

ll;f;li lilPal Ht•t•ii'I 80 S OUTH EIGHTH STREET IDS CENTER MINNEAPOLIS, MN MAIN: 2. .FAX 2.6 .MICHAEL R. COHEN ATTORNEY DIRECT DIAL: ..DIRECT FAX: ..MICHAEL.CO H EN@G PM LAW.COM March , Office of the Attorney General C on sumer Protection and Antitrust Gateway Profe ss ional Center E Interstate Ave nu e Suite Bismarck, ND -VIA U.S. Ma il an d e mail ndag@ nd .g ov Re: No tice of Data Security Incident D ea r Sir or Madam: We represent CHS I nc . lo ca ted at Cenex Drive, Inver Grove Hei gh ts, Minnesota -. W e a re writing to notif y y our office of the ina dv ertent dis clo sure of perso na l i nformation of No rth Dakota residents. Wh il e we do not be li eve this constitutes a notifiable breach or that any of the information has b ee n misused or w ill b e used inappropriately, w e a re s ub mi tt ing this notice to be as tra ns pa rent as we can about this incident. On Februa ry , , a file with persona l i nforma ti on of CHS employ ee s and their dependents was ina dv ertently sent via email to a CHS vendor. CHS immediately be ca me aware of the mistake and that same da y p romptly notified the ve nd or. The vendor confirmed tha t t he perso na l information had no t b ee n a cc essed a nd the files with persona l i nformation were promptl y d eleted. To the best of our knowledge, the security, confidentia li ty, and integrit y o f the persona l i nformati on that was inadvertentl y d is clo se d fo r a very short peri od of time was never misused or compromised in any way. Notice to Res id ents CHS has provided written no tice of this inciden t t o all of t ho se North Da ko ta residents whose personal information was dis clo sed. What Information Wa s Involved? The information on th e fi le was ol d d ata from and was related to employee ben efi ts and included names, a dd resses, and the employee number for employ ee s, and the names, birthdates, gender, type of de pen dent, benefits en roll ed in, smoking status, life insuran ce a mounts, the health insurance plan election, and the social s ec urit y n u mb ers of dependents. What Steps did CHS Take in Response? Immediate acti on w as taken to make sure tha t t he files with a ny p ersona l i nformation were deleted. CHS has b ee n a ss ured by the v en dor that no further unauthorized disclosure or use was made of GRAY, PLANT , M OOTY, MOOTY & BE NN E TT , P.A. A FULL-SERVICE LAW FIRM MINNEAPOLIS , M N • ST. CLO UD , MN • WASHINGTON, DC FAR GO , ND WWW.GPMLAW.COM

Office of the Attorney General March , Page the data. In a dd ition, CHS is t ak ing steps to m ak e sure t ha t such in adve rtent dis clo sure do es not h appe n again. Contact Information Should y ou hav e a n y q uestions r ega rding this inci den t or notification please contact me at Very truly yo urs , .~L / Michael R. Co hen I cc: Naomi M oo re (via email) GP:--v I