Estimated read time: 3-4 minutes
This archived news story is available only for your personal, non-commercial use. Information in the story may be outdated or superseded by additional information. Reading or replaying the story in its archived form does not constitute a republication of the story.
SALT LAKE CITY — Social Security numbers and personal medical information of an uncertain number of Salt Lake County employees were exposed for several months in a data breach this summer.
Employees who filed workers' compensation or third-party claims with the county may have been accessible from the Internet from June 18 to Sept. 9, Salt Lake County Mayor Ben McAdams said in a prepared statement Monday.
"Since we became aware of this incident, the county's primary concern has been the privacy and protection of any personal information which may have been accessed," McAdams said. "We are working to identify potentially affected individuals. The county will notify and offer appropriate services to those affected. At present, we have no evidence of the misuse of any personal information."
The breach occurred during a scheduled upgrade by third-party software vendor Systema Software, a California-based company that provides workers' compensation, property and auto insurance for clients in Utah, Kansas and California.
The health care business news publication Modern Healthcare reported 1.5 million records were exposed in the three states.
The mayor's spokeswoman, Alyson Heyrand, said in an email Tuesday that while some online publications have reported that 29,000 individuals from Salt Lake County were affected, the number isn't accurate. Salt Lake County employs roughly 3,000 people.
"It will be a few days before we have an exact number of those whose data was affected," Heyrand said. "We are still compiling information, but everyone affected will receive a personal letter from the county to let them know of the services available to them."
System Software said in a statement released Tuesday that a "single individual gained unapproved access" to data belonging to some of their clients.
"In addition to communicating with Systema, this individual self-reported this discovery to the proper authorities and impacted clients," according to the statement. "The privacy and security of our clients' information remains our top priority, and once we learned of the unapproved access, we immediately took several proactive steps to identify and remediate the issue."
Since we became aware of this incident, the county's primary concern has been the privacy and protection of any personal information which may have been accessed. We are working to identify potentially affected individuals. The county will notify and offer appropriate services to those affected. At present, we have no evidence of the misuse of any personal information.
–Salt Lake County Mayor Ben McAdams
Justin Miller, executive director of the Utah chapter of the American Federation of State, County and Municipal Employees, said the union is concerned that the county informed its employees two weeks after it discovered the breach.
"The county has a history of being a good employer," he said. "To be honest, I was a little bit surprised that it took two weeks and a phone call from the press to start talking about this issue."
Miller said each day that goes by, employees could have been more on guard, checking their credit reports. Instead of taking time to first target only the employees who were affected, the county should have informed all employees of the data breach.
"I would have liked to have seen a more thoughtful and inclusive conversation with all the county employees," he said.
McAdams said the county is conducting a thorough review of its data security to make sure its third-party vendors have proper security measures in place.
"We deeply regret any inconvenience or concern this incident may cause and want to assure our employees and the public that the county is taking steps to remedy this situation and prevent this type of incident from occurring in the future," the mayor said.
Contributing: Jed Boal
