Leak Exposed Securities and Exchange Commission Workers' Data

Personal information on employees at the Securities and Exchange Commission has been popping up on other federal agency computers after a former SEC worker downloaded names, birthdays, and Social Security numbers and transferred them to another network.

According to the Hill, Thomas Bayer, the SEC's chief information officer, disclosed the security leak in a July 8 letter in which he warned workers their data was discovered on another agency's computer system. The letter explained that the information had been downloaded "inadvertently and unknowingly" by an SEC employee who had left to take a different government job.

The former employee had downloaded SEC templates to help in his new position at another federal agency, The Hill reported. But at the same time he had somehow downloaded the personal data of some of his SEC colleagues. Then he uploaded the sensitive information twice to a computer network at his new agency.

The SEC has confiscated the thumb drive he used and the data will be permanently removed from the other agency's network, the newspaper noted.

The SEC apparently didn't learn about the breach until nearly a year after it occurred. The compromised information belonged to employees who worked at the agency before October 2009. It's unclear how many were affected. But an SEC spokesman said employees who were financially compromised by the incident are being offered a free year of credit monitoring.

Bayer's letter said there is no evidence that the personal data ended up in the wrong hands, but former employees complained that the incident shows problems with how the agency handles information.

"What if he’d gone to the private sector? What if he’d dropped that thumb drive somewhere, with mine, and I’m assuming quite a few other people’s, personal information?" Hester Peirce, a former staff attorney at the SEC whose personal data was compromised, wrote in an opinion piece for The Hill.

"Human error is something we really have to worry about."

Peirce and other SEC employees were notified about the breach not long after the agency's inspector general recommended the SEC take steps to secure its nonpublic information.