Arbiter Data Breach

[gamefaceref]

Originally Posted by BillyMac

I received a USPS "snail mail" from Arbiter today regarding this subject.

Usernames, passwords, names, addresses, birth dates, email addresses, and Social Security numbers were all compromised.

Arbiter paid the hacker's ransom demand to delete the stolen files.

Arbiter suggests that we change our passwords and offered two years of free Experian Identity Works Credit 3B to protect our identities.

My letter says 1 year Experian membership....no an acceptable resolution in my opinion. Should be at least three years, but if you are getting two years for some reason than that reveals other issues that need to be addressed. With all the information they got what is to say that they did not also get our banking information that is on there for payments?

[Nevadaref]

This adds more fuel the my fire in my ongoing dispute with Arbiter over their storage of our SSNs in their system. I object to that and have fought unsuccessfully for years now to be able to remove my personal info during the off-season. In fact, I prefer to only enter my SSN when the treasurer of my group runs payroll or creates the 1099s and then take it back out. The problem is that Arbiter locks the SSN field on the profile page and prevents you from changing or deleting the info therein. Please join me in calling the Arbiter personnel and demanding that we have control over this data and can remove it at will. It is not theirs and they are not our employers.

[sdoebler]

Originally Posted by Nevadaref

This adds more fuel the my fire in my ongoing dispute with Arbiter over their storage of our SSNs in their system. I object to that and have fought unsuccessfully for years now to be able to remove my personal info during the off-season. In fact, I prefer to only enter my SSN when the treasurer of my group runs payroll or creates the 1099s and then take it back out. The problem is that Arbiter locks the SSN field on the profile page and prevents you from changing or deleting the info therein. Please join me in calling the Arbiter personnel and demanding that we have control over this data and can remove it at will. It is not theirs and they are not our employers.

I understand why they do it, for ease and integration into Refpay as an upsell. However, as with you I wholeheartidly agree they should not be storing this informatioin in the manner they do.

[sdoebler]

Originally Posted by Altor

FWIW, I have a separate bank account that I only use for officiating transactions (makes it easier for end of year accounting). I try to keep the balance low (around $1000...write a check to myself at the end of a season). If you are like me and have no choice but to work with Arbiter, you might consider something similar. At least it limits your exposure.

Originally Posted by LRZ

I have a separate savings account for arbiter and several schools that pay by direct deposit. There is a $300 minimum to avoid fees, which is not a problem. Once I get maybe $400-$450 total, I transfer the overage into another account.

Good ideas, I had been considering this idea for taxes and tracking for a while, upset I didn't institure sooner.

[HLin NC]

have a separate savings account for arbiter and several schools that pay by direct deposit. There is a $300 minimum to avoid fees, which is not a problem. Once I get maybe $400-$450 total, I transfer the overage into another account.

Football guy here.
We've been told for years that we needed to get on board with Refpay as it was "coming". Originally, we had one HS that was paying via Refpay and the prevailing thought was, if I don't sign up, I just won't be sent to that high school.

Fast forward to 2019. I eventually signed up for RefPay. I MIGHT get a game check via that method once every two or three seasons. Our region's schools have just never bought in. We still receive a game check at the game site. A handful of schools will send via US Mail after the game.

I note that financial info is not listed as data that was breached although at this point, who knows if Arbiter can be a trusted source of information.

NC is moving off of Arbiter to DragonFly. With the year that 2020 has become, all we have done so far is register for the state and take the Fed exam via DragonFly. Our local assigner is still on Arbiter for local registration but he apparently has had a hack of his own PC network so don't know what happens with him. I have not registered locally yet since we aren't scheduled to play FB now til February

[JRutledge]

We register for Arbiter Pay even if the assignment does not come from Arbiter. Many colleges still use some form of Arbiter even if they are assigning games through Blue Zebra for example. Indiana even uses Arbiter Pay at most schools I have been assigned and they have gotten away from the assignment part of the site and are using Eventlink (hate this site) for most assignments.

I still have not gotten any letter from Arbiter about this, but got an email last week.

Peace

[Altor]

Originally Posted by gamefaceref

With all the information they got what is to say that they did not also get our banking information that is on there for payments?

A friend called the number to ask this question. The response was that they will get back to him in 3-5 days. It might be best to talk to your bank and see if they suggest you close that account and open a new one.

All the information anybody needs to do an electronic transaction is on a check, so it's not like there isn't plenty of ways for this information to be obtained anyways. But, I don't like the fact that a known bad actor is known to have this information now.

FWIW, I have a separate bank account that I only use for officiating transactions (makes it easier for end of year accounting). I try to keep the balance low (around $1000...write a check to myself at the end of a season). If you are like me and have no choice but to work with Arbiter, you might consider something similar. At least it limits your exposure.

[LRZ]

I have a separate savings account for arbiter and several schools that pay by direct deposit. There is a $300 minimum to avoid fees, which is not a problem. Once I get maybe $400-$450 total, I transfer the overage into another account.