ROCKVILLE, Md. — Personal and banking information belonging to about 7,500 Montgomery County retirees, firefighters and volunteers was mistakenly emailed to county employees and volunteer leaders.
The June 4 disclosure occurred while the county was arranging direct deposit reimbursements for Fire and Rescue volunteers, officials said during a County Council committee hearing Thursday, according to WUSA.
An Excel workbook contained more information than intended, including names, bank account numbers and routing numbers. Some volunteers’ mailing addresses also were included, but Social Security numbers were not exposed, WUSA reported.
The email went to six county employees and 62 volunteer Fire and Rescue leaders. Most recipients used county email accounts, but 11 used outside accounts, the report stated.
Efforts to Remove Email
Officials began removing the email from county systems after discovering the mistake. More than 3,300 messages were ultimately deleted during a search for copies and related correspondence.
However, the county cannot determine what happened to information sent to the outside accounts, Chief Information Security Officer Keith Young told the committee.
“For those 11, I would say that we don’t know what happened after the email was sent to those 11 people,” Young said.
The county contacted those recipients and asked them to delete the email. Officials said they have found no evidence that the exposed information was misused, WUSA reported.
Young said investigators determined the disclosure resulted from human error and improper handling of sensitive information, rather than hacking, malicious activity or unauthorized access to county systems.
Procedures Revised
The county has since revised its procedures. Heather Black of the county’s Department of Finance said employees now use a checklist for nonstandard reports, and additional review may be required before information is sent, WUSA reported.
Officials also are considering technological safeguards to flag, suppress or block sensitive banking information before it leaves county systems, according to WUSA, which said affected individuals were notified by mail and, when the county had an address available, by email.
