United States Veterans Administration Data Breach (2015)

A former lab worker at the Veterans Hospital in Madison used information stolen from VA records, from mail stolen from her neighbors and information purchased on the Internet to obtain credit cards and access other people's checking accounts, according to criminal charges filed this week. Elizabeth Feng, 23, of Madison, was charged Thursday with 17 counts of identity theft, two counts of misdemeanor theft and two counts of unauthorized opening of mail in the scheme, which began to unravel on May 30 when her boyfriend tried to make a legitimate payment on some parking tickets at the Madison Police Department. Police have issued a warrant for Feng, who was also a UW-Madison student at the time. According to a criminal complaint filed Thursday, the boyfriend went to pay parking tickets after his car had been impounded, only to be told that he had to pay in cash because fraudulent payments had been made for tickets on his car in the past. Police staff had found that the earlier citations were paid using the checking account information of people who lived in New Jersey, Vermont, Connecticut and Mississippi, and that one of those people had contacted police about the fraud, the complaint states. The man told police the earlier payments had been made by his girlfriend, Feng, the complaint states. According to the complaint: Contacted by police, Feng at first admitted to using a "random person's account" a couple of times, from information she found on a website. But pressed further, she admitted taking mail belonging to other people in her apartment building in the 400 block of West Dayton Street, not cashing personal checks sent to her neighbors but using account number and bank routing information on them to pay her boyfriend's parking tickets online. Among the items taken from Feng's neighbors' mail were also packages of goods such as a wine opener, clothing and a cutting board and knife. Feng said she threw most of that stuff away. In her apartment, police found opened mail and boxes addressed to other people. Feng opened six credit card accounts using information for five patients stolen from the VA Hospital, where she worked. She had mail for the accounts addressed to the apartment of one of her neighbors, who told police he was shocked when informed that there were 16 credit cards in 14 names associated with his address. The man said that when he received mail that wasn't addressed to him, he would drop it on the floor by the mailboxes. Police also found a large number of Capital One credit cards in Feng's apartment and found the names on them matched a list of 15 names and Social Security numbers that police found on a document located on Feng's computer. Two of VA Hospital patients had since died. The son of one of those men told police that on the day of his father's funeral, his mother received a phone call from Capital One asking if his father had recently opened a credit card with them. Feng had worked as a medical assistant in the hospital's pathology and lab department. She left her job on May 31. The hospital's lab manager told police that Feng would have had access to patient information including birth dates and Social Security numbers.