Montgomery County, Maryland, staff accidentally shared the bank account information of more than 7,500 people, according to a memorandum to members of a council committee regarding the June incident.
The banking information belonged mostly to county government retirees, along with some volunteer and fire and rescue service staff, and was shared with the Montgomery County Fire and Rescue Service and 68 current and retired volunteer fire chiefs and presidents.
According to the memorandum, the county currently has no evidence that any of the information has been misused.
The breach happened during an annual process that pays a nominal fee to certain volunteer eligible volunteer firefighters, according to an incident report cited in the memorandum. Historically, the county has paid that feeomated electronic payment
Montgomery County Fire and Rescue staff sent an email June 4 to the Local Fire and Rescue Department fire chiefs and board presidents to assist with the process. That email contained a Microsoft Excel workbook attachment that staff believed only contained data cleared for release, according to the memorandum. The workbook, however, included three additional worksheets with names, addresses, bank account numbers and bank routing numbers.
That entire workbook was transmitted to fire and rescue staff May 28, but the department was not aware of the overshared data until after it was shared June 4 with local volunteer department chiefs and presidents.
When staff shared the sensitive information June 4, it went to 57 government email address and 11 external-domain addresses, such as Gmail. Within an hour of the message being sent, the county conducted an “administrative deletion” of the email for all recipients with a government email address.
The county also notified fire officials and various county departments, along with the state’s Department of Information Technology, the same day the email was Excel workbook was shared externally.
Affected volunteers, county retirees and fire and rescue service employees were notified “on various dates in June,” according to the memorandum to the Montgomery County Council Joint Public Safety and Government Operations and Fiscal Policy Committee.
The county’s incident report determined the data breach was not the result of malicious action.
According to the memorandum, several impacted individuals were concerned about the incident and requested credit monitoring services from the county. The county executive office’s incident report, however, stated the “likelihood of the information being misused [is] low,” and “determined that the identity theft protection and credit monitoring services would have limited effectiveness in detecting or preventing the potential misuse of bank account information.”
Since the breach stemmed from human error, the executive’s office said an independent audit or external review of the incident was not warranted.
Get breaking news and daily headlines delivered to your email inbox by signing up here.
