A state employee whose stolen laptop contained the names and Social Security numbers of more than 100,000 Connecticut taxpayers had permission to take the computer out of the state, but not the data, the state tax commissioner said.
Pam Law, who apologized for the incident during a legislative hearing, said the Department of Revenue Services is still investigating why the information was on the employee’s desktop computer for eight months and, at some point, the laptop.
While the worker had a legitimate business reason to look at the data, she said it shouldn’t have been on his computers.
“The question now becomes … why was it still on his laptop and I do not, at this point, have an answer to that question,” Law told legislators, some of whom received notices from DRS that their names or their spouses’ names were among those taxpayers whose information was on the stolen laptop.
Monday’s hearing marked the first time Law has spoken formally in public about the security breach. She said her agency has received no indication that the data has been accessed or misused.
Law said the employee, who has not been named, was working on Friday, Aug. 17, at DRS, testing the agency’s new Taxpayer Service Center, which allows businesses to check their taxes online. He had a family event in Long Island, N.Y., that night and was given permission by a supervisor to bring a laptop with him to further test the new system and report his findings during a conference call the next day.
But the man’s car was burglarized that Friday night. The laptop and other items were stolen. Police have not yet found the portable computer.
No one has been punished for the incident, but the matter is still under investigation.
Law said it appears that the single largest file on the computer, which included information on 93,208 taxpayers, was generated in December 2006 for testing purposes and that’s why the employee had it on his desktop. It appears that his entire desktop computer hard drive was later copied onto the laptop computer.
Besides taxpayers’ Social Security numbers, there were files with information about federal adjusted gross income, Connecticut income tax, total tax, withholding, overpayments and refunds. The laptop also had the banking routing numbers and bank account numbers for 1,618 businesses.
The information on the laptop was not encrypted. But since the theft, all the agency’s 154 laptops have been encrypted, making it difficult for them to be hacked. DRS officials said the laptop encryption program had begun before the Long Island theft.
All the laptops have been purged of any sensitive data, said Cal Mellor, the assistant chief of the tax division.
DRS has also hired Debix, an identity protection vendor, to provide credit protection to the 106,000 individual affected taxpayers for two years, an extension of the original one-year offer.
Rep. J. Brendan Sharkey, D-Hamden, whose name and Social Security number were among those on the laptop, criticized DRS for not being more forthcoming about the incident. He said it was a shame the legislature had to hold a public hearing to get answers.
“I personally was struck in the early news reports by what appeared … a real nonchalance coming from the department as to the seriousness of this particular incident,” he said.
Law said her agency tried to get information out to the public as soon as possible. But she said it took 11 days for the notification because of the time it took for the employee to notify the proper people at DRS, for the agency’s security expert to analyze the employee’s desktop computer and files, and for Debix to be hired.
“We tried to get the information out as quickly as possible as we could,” Law said. “If there is some reason that I somehow shirked that, I would like to apologize.”
