OHIO DATA STOLEN FROM LUCAS COUNTY CHILDREN SERVICES- toledoblade.com -Article published Tuesday, June 28, 2005

Lucas County Children Services data stolen

By DAVID PATCH
BLADE STAFF WRITER


About 900 current and former employees of Lucas County Children Services are being advised to watch and protect their commercial credit after information from the agency's personnel database was compiled and e-mailed to an outside computer, executive director Dean Sparks, the agency's executive director, said.


Members of Children Service information services staff discovered the unusual activity on agency computers and "have been working on it for a few days," Mr. Sparks said yesterday.

Lt. Mel Stachura of the Toledo Police Department said an agency employee is the prime suspect. But because of a backlog of work at a state agency, it could be many months before an arrest - or a determination of how widely the stolen data may have spread - is made, he said.

The information compiled and taken includes names, telephone numbers, and Social Security numbers for the agency's 400 current employees and about 500 others who have worked there at one time or another since 1991, Mr. Sparks said.

No information about Children Services clients is believed to have been compromised.

Current employees have been notified by agency e-mail about the situation, and letters are being sent to the former employees, Mr. Sparks said.

The notices urge everyone affected to put their credit records on fraud watch in case someone tries to use their personal data.

Mr. Sparks confirmed that an agency employee is suspected.

"We believe that we know who it was. I'm not prepared to talk about that until the criminal [investigation] is done," he said.

Lieutenant Stachura said the information would be enough for someone to establish fraudulent credit identities, but investigators don't yet know if it was distributed beyond five computers and data media that authorities seized yesterday from an undisclosed location in Monroe County following the serving of a search warrant.

Why the information was taken is "what I'm trying to figure out," the lieutenant said yesterday. One lead being pursued is that some sort of workplace animosity between the prime suspect and agency management is involved, he said.

But because the Toledo police no longer have a computer division, analysis of the seized computers' contents will be turned over to the state Bureau of Criminal Identification and Investigation, and Lieutenant Stachura said he has been told to expect a seven-month turnaround from that agency because of its backlogged caseload.

Local investigators "have a pretty strong case" against the primary suspect, but they need confirmation that the stolen data was found in the suspect's personal computers before they can file charges, the lieutenant said.

The computer analysis is also needed to discover if the information was distributed anywhere from those computers, he said.

The case appears to be a small example of a growing problem: the theft or loss of sensitive personal information stored on computers.

Eleven days ago, MasterCard International reported that a computer security breach at a payment processing company in Arizona exposed up to 40 million credit card accounts to fraud.

On June 6, Citigroup Inc. reported that United Parcel Service Inc. had lost a package containing data tapes for 3.9 million of its consumer finance customers.

Other similar incidents have affected such prominent firms as Bank of America, Wachovia, Time Warner, and data brokers ChoicePoint and LexisNexis.

While some of the breaches have been exposed when authorities identified unusual patterns of activity on compromised credit accounts, there is a growing fear that leaked personal information, such as birth dates and Social Security numbers, could lead to recurring "identity theft" as thieves sell that data to others who may use it to obtain credit cards or loans under faked identities.
Contact David Patch at:
dpatch@theblade.com
or 419-724-6094.