Personal, confidential information from more than 110,000 people who sold homes in 2011 was hidden inside a Wisconsin Department of Revenue report used by real estate and appraisal organizations.
The DOR has ask those organizations to destroy and replace the report, which was posted online for download from April 5 to July 23. The department said that while the information was in the file, it was not visible when the report was opened. However, someone who opened the specific file would have had access to the information, the DOR said.
"We have a responsibility to protect the sellers who had their personal information included in the report, and we have reached out to the real estate and appraiser organizations to contact their members to destroy the file," DOR Secretary Richard G. Chandler said in a press release. "We know the individuals who downloaded this file are using it for their own business purposes and have no malicious intent, yet we will be offering free credit monitoring for a year for the individuals who may have been impacted by this situation."
The report contained 110,795 Social Security numbers of individuals and tax identification numbers of businesses, the DOR said. The number of people affected will be fewer because some of the numbers were associated with businesses and some individuals made multiple sales.
This is not the first time the agency has had breaches of confidential information. It comes after incidents in 2007 and 2008, the DOR has confirmed, and this new breach occurred despite "strict internal procedures related to the use of personal information," according to the press release.
The report was removed immediately after a user notified the agency of the buried file. A clean report without the unauthorized information has been reposted.
Letters have gone out to sellers who may have been impacted, offering them free credit monitoring services for one year. Sellers who do not receive a letter can contact the DOR to confirm whether or not their Social Security number was included on the form.
Huffington Post blogger Adam Levin, founder of Credit.com and former director of the New Jersey Division of Consumer Affairs, called the breach "a bargain" for identity thieves, and criticized the state's minimzing of the possible ill intent of people who downloaded the information.
Even after hundreds of thousands of innocent "Cheeseheads" have been exposed to identity theft and all manner of financial crimes; even after the state has spent (or will spend) more than $1 million on credit monitoring for victims (which doesn't really help anyway, since all the thieves have to do is wait a year plus one day to begin their wild spending sprees using the purloined Socials); Scott Walker's appointee had the audacity to imply that he believes the people of Wisconsin are safe.
He also offered the DOR two free weeks of consulting to at least start an evaluation of the agency's security protocols and to develop a plan for responding to breaches like this.
