Case Study: Addiction Counseling and Rehab Centers Protect Against Violent Attacks and Improve Recruitment/Retention
Customer: An addiction counseling and drug rehabilitation provider
Challenge:
- Spike in deadly attacks by drug cartels targeting addiction centers
- Concerns about physical safety of counselors and executives from grief-stricken survivors and patients failing to recover
- Difficulty attracting and retaining talent due to perceived risk of workplace violence
- Risk of data breach in an industry where discretion is essential to business model
Solution:
- Market research to identify Privacy Bee for Business
- External Data Privacy Audit and Privacy Risk Assessments provide data-driven metrics of existing privacy risks and exposures
- Employee Risk Management solution enabled to manage DSARs and begin reducing numbers of exposures at Data Brokers, People Search Sites, DarkWeb and elsewhere
- Privacy Bee University training deployed for all employees
Results:
- Risk profile for individuals and organization dramatically reduced
- No physical attacks or threats received by employees
- Privacy data visibility enabled more actionable management
- Demonstrable commitment to data privacy and physical security yielded improved staffing sourcing and employee retention results
- Customer able to leverage privacy metrics in marketing to increase new business acquisition
Customer: An addiction counseling and drug rehabilitation provider with more than a two-dozen clinics operating across the American south and southwest.
Challenge: Drug addiction is, by definition, a dangerous proposition for everyone concerned – the addict, their family, their dealers and also, those serving in addiction counseling/rehab. Addicts often become agitated and, in many cases, violent as they struggle to come to sobriety. Trafficking in illegal substances forces many addicts into relationships with dangerous criminals including local drug dealers and the powerful cartels that produce and distribute the illegal substances. Additionally, addiction frequently takes a powerful toll on families of those struggling with substance abuse. And when rehabilitation fails, and addicts fall back into using – or worse, overdose and die – angry loved ones sometimes take leave of their rational sensibilities as they seek someone to blame for their loss.
Add to this emotionally charged and volatile operating environment, the powerful profit motive of drug cartels when it comes to protecting demand for their product, and things get even more dicey. American Addiction Centers published an article titled, “Why Drug Cartels Keep Attacking Rehab Centers”. In the piece, they note, “Drug running and manufacture is about one thing: money. Like any other business, it requires money to pay people and money to carry on operating. Due to the illegal nature of the goods, however, it’s impossible to enforce debts and so on within the law. Therefore, cartels rely on the routine use of violence to intimidate those who owe them money to get them to cough up. Rehab centers are filled with people who owe the cartels money. This leads to the cartels raiding the rehab centers to threaten and possibly wipe out people as an example. To the drug cartels, it’s just business sense to do this.”
For this reason, drug rehab centers have been experiencing a spike in violent and deadly attacks sponsored by drug cartels. Some recent examples include the death of twenty-four and injury of seven others at a drug treatment center in 2020, and the murder of six at another center in 2022. A basic search returns many more such incidents.
For this customer, the increasing threat of violence on the job had been having a depressive effect on their ability to source qualified therapists and support personnel. Given their proximity to drug cartel activity, with addiction centers in border states of Arizona, New Mexico and Texas, the impediments to staffing were having an acute impact on recruitment and retention. Adding to concerns about employee safety, was the growing frequency of attacks against rehabilitation workers and the prospect of enterprise-ending consequences following a deadly attack. Whether due to reputational damage or costly liability litigation, this customer began seeking proactive, prophylactic measures against violent attacks.
Solution: Taking proactive measures to reduce their attack surface and protect employees from being targeted – whether by disgruntled customers, families or violent cartels – the customer began a campaign of increased privacy protection. After finding Privacy Bee for Business in their search, the customer became convinced the solutions offered would be perfect for protecting their organization from doxxing, exposed location threats, physical violence and retaliation.
The customer already had strong cybersecurity policies and practices in place as the nature of their work calls for great confidentiality and discretion. However, their research highlighted the vulnerabilities inherent in allowing external data privacy to be left un-managed. It quickly became apparent that, while they could employ strong physical security, cameras, guards and so forth, employees’ personal information was easily available online. And threat actors could use it to focus attacks on the employees at their homes or outside of the workplace.
The Privacy Bee for Business solution was also perfect for protecting the entire organization against the mal effects of data breaches which cost the healthcare industry millions every year.
Employee Risk Management was enabled after Privacy Bee scanned thousands of external sources, revealing a significant volume of exposed privacy risk on many of the customer’s employees and staff. The External Data Privacy Audit and Privacy Risk Assessments – both free services offered as part of the Privacy Bee platform – yielded quantifiable measures of risk and vulnerability. It also provided a clear accounting of actual exposures at hundreds of locations on the web. From Data Broker Sites to People Search Sites to the DarkWeb and more.
Discoveries of exposures and vulnerabilities were flagged, included in each employees’ aggregated Privacy Risk Score and were processed for deletion requests. Over time, as Data Subject Access Requests or ‘DSARs’ were processed for the licensed employees and practitioners, individuals’ risk scores improved, and the overall risk profile of the customer organization fell dramatically.
Executives and therapeutic practitioners were all required to engage with Privacy Bee University, for easy-to-absorb trainings on the contemporary privacy threats and how to minimize risk of being victimized. The Privacy Bee University program focuses on modern threats to a business, including External Data Privacy, the exploitation of People Search Sites to craft highly personalized (and convincing) attacks, and other ways that bad actors bypass your cybersecurity by tricking employees.
Results: Having this level of visibility enabled the customer to set targets for the reduction of unsecured external data. Over the course of the first 18 months of the service, the customer’s risk profile fell from exceptionally high to well within tolerances accepted as best practice by the industry.
No physical attacks or inbound threats were reported and, although it is difficult to quantify the extent to which improved data privacy was responsible, executive leadership expressed great relief at having quantifiable evidence that their risk profile had been dramatically lowered.
As a result of being able to measure and manage privacy risk across their entire organization, the customer was now able to illustrate in great detail the organization’s commitment to data privacy and workplace safety/security. They reported that their time-to-fill and overall staffing sourcing times had been greatly reduced and that employee retention levels had increased in a correlated fashion. They’ve also been leveraging their dedication to privacy and security as part of their marketing efforts to attract new customers and grow their profitability.
