WISCONSIN STOLEN COMPUTER RECOVERED WISCONSIN STATE JOURNAL:

MON., JAN 26, 2009 - 12:40 PM
Personal data was stored on laptop swiped from Madison city hall
Dean Mosiman
608...
dmosiman@madison.com

Madison officials and employees are complaining that Social Security numbers were stored on a laptop computer stolen from a city office Friday.

The laptop was recovered this morning, but it's unclear if sensitive information was stolen.

Any official or employee — except those in the police, fire and transit departments — who was issued a new or replacement city identification card from the start of 2004 through 2007 may be at risk of identitytheft, Human Resources Director Brad Wirtz said.

The photo, name and Social Security numbers of those employees, potentially 300 to 500 people, including people in the mayor's office, City Council members and others, are on the laptop, which was stolen from a Human Resources Department office, Wirtz said.

The information is password protected but that may not provide enough protection to prevent identity theft, he said.

The laptop was found on South Hamilton Street and turned into police, Wirtz said. The city is now checking to see if the information was accessed, he said.

"Hopefully, no one's information was compromised," he said.

The Human Resources Department is recommending that any current or former employee who got a new or replacement photo ID during the four-year period immediately take steps recommended by the Federal Trade Commission. The photos are often taken to get city bus passes.

In letters to employees this morning, Wirtz apologized for the incident and said the department is working with the information technology unit and the police to protect private information.

"There's not much more that I can do than apologize," Wirtz said. "We're hoping nothing will happen to any of these employees."

Rachel Strauch-Nelson, spokesperson for Mayor Dave Cieslewicz, said, "We're obviously concerned. We're going to work with IT and HR to make sure all necessary precautions are taken.

Ald. Thuy Pham-Remmele, 20th District, fired a scathing e-mail to Wirtz on Monday morning, saying the initial apology is insufficient and calling the incident "an unacceptable breach of all basic rules of internal control."

Pham-Remmele also pressed to know if there are other laptops that contain sensitive personal information. In a later e-mail, she expressed relief the laptop was found.

The incident was an isolated situation, Wirtz said.

The stolen laptop was in a "relatively secure location" in the City-County Building marked off as being for authorized personnel only and behind another set of doors, he said.

The room, he said, is used for employee testing and orientation and taking photo IDs.

From 2004 through 2007, the city kept the employees' name, photo and Social Security number on the laptop, which helped identify employees if they lost their IDs, he said.

Shortly after he became the director in September 2007, Wirtz got a new ID, recognized the security threat, and stopped what he believed as a "bad practice." But the earlier information was never deleted from the laptop, he said.

"We just didn't think the computer was going to be stolen," he said. "We thought it would be eventually phased out."

The incident doesn't represent a threat for other sensitive information, Wirtz said, noting that the stolen information exists only on that laptop, which was not a network computer. The rest of the city's sensitive information is encrypted and on the mainframe, he said. The information will be deleted from the computer after it is analyzed, he said.