MONTPELIER — The Vermont State Police have launched a criminal investigation into a former Vermont Department of Labor employee that “acquired” the names and social security numbers of at least 39 people from the department’s unemployment database.
The department said the former employee intentionally acquired the unauthorized information through her regular work duties. Although she had access to the information through her work, the department does not allow its employees to copy, transfer, disclose or retain that information for any purpose that is not related to the department’s business. No computer systems were breached, according to the department.
Officials did not identify the woman accused of acquiring the personal information.
In a press release, the department said the data was acquired on Feb. 24. Officials immediately asked the Vermont State Police to begin a criminal investigation. Police were granted a search warrant for the woman’s home and seized copies of documents and personal computer devices to aid the investigation.
The Labor Department said it also reported the breach to the Vermont Attorney General’s Office, the Department of Information and Innovation, the Department of Human Resources, the U.S, Department of Labor and the Internal Revenue Service.
The Labor Department said Friday that the criminal investigation is ongoing, but some information is known. The names and social security numbers of 39 people, and an additional 41 social security numbers not associated with names, were in the woman’s possession. The quarterly wage reports of seven people were also improperly accessed, but no Federal Employer Identification Numbers appear to have been involved.
The Vermont State Police are continuing to examine the items seized in the search, including data on the woman’s home computer and from her internet provider, but have not yet identified any transfer of data to other people or entities. As a result, the Vermont Department of Labor said Friday it believes the risk of identity theft is minimal.
All people affected by the data breach will receive a written notice from the department alerting them that their personal information was improperly accessed. The letters, which will be sent out no later than March 28, encourage individuals affected by the unauthorized access to call the Department of Labor if they have questions, check for information posted on the department’s website and to conduct credit monitoring as recommended by the Vermont Attorney General’s Office.