Metropolitan Council Data Breach (2012)

In June 2015, former Metro employees, Michael and Margaret Abbott, were informed by the Internal Revenue Service (IRS) that they were victims of identity theft and that someone attempted to file a fraudulent tax return in Michael Abbott’s name. In August 2016, the Abbotts learned that their names, addresses, and social security numbers were inadvertently exposed in an HR Department training manual that had been posted on Metro’s public website from 2012 to 2016. The Enterprise Business Solutions (EBS) manual was created by HR in 2005 for internal use by Human Resources coordinators from each department. The EBS manual contained actual employee data and a total of 21 social security numbers were exposed. The EBS manual was placed online in December 2012 for ease of access to HR coordinators, but was also publicly available to anyone. On August 4, 2016, an HR coordinator from the Arts Commission reported a concern that the manual appeared to use actual employee data. The manual was removed from the website that same day, and the HR Department destroyed all paper copies of the training manuals and revised them to remove sensitive information. The EBS system had already been modified by the HR Department a few years earlier to mask sensitive employee data. All affected employees, including the Abbotts, were notified of this breach by certified letter on August 24, 2016 and offered two years of identity theft protection insurance. The Abbotts were notified by the IRS of the attempted false tax return, but did not lose any potential tax refund they were owed. They were offered one year of free identity theft protection from Metro HR and have since purchased their own identity theft insurance, which they intend to maintain indefinitely at a current cost of approximately $160 per year. Ms. Abbott has a history of stress and anxiety related medical issues and suffered a stress related heart attack in July 2015, one month after the letters from the IRS concerning identity theft. The statutory claims asserted in their complaint include provisions for attorneys’ fees and costs. The Abbotts have agreed to accept a total of $22,000 in full settlement of this case.