Wright County alerting residents of data breach involving county employee

BUFFALO, Minn. (FOX 9) - Taking work home with you sounds like something a hardworking employee would do, unless that work includes private, sensitive data like it did with one employee in Wright County.

The county knew about the data breach for seven months before notifying possible victims.

It wasn't until FOX 9 filed a public records request that Wright County notified victims of the data breach.

Now it is seven months after the county became aware that more than 1,000 people were potential victims of the breach.

At the Wright County government building are public employees who have access to hordes of private data.

In December 2016, one of those employees, a senior developer in the IT department, copied a database full of sensitive personal information onto a USB drive.

He then transferred the information onto his home computer, giving him access to social security numbers of more than a thousand people.

In a statement to FOX 9, County Coordinator Lee Kelly said "No evidence has been found that indicates there was any sale or distribution of the private data. The data was recovered and returned to the county by law enforcement."

However, documents show the county knew about the breach for the seven months before they notified potential victims.

Minnesota state statute says a government entity that collects private data "must disclose any breach" through "written notification" to anyone who may have been affected.

The statute goes on to say the notification "may be delayed if a law enforcement agency determines that the notifications will impede an active criminal investigation."

While the county claims such an investigation is still ongoing, the employee’s termination letter says an internal investigation determined he engaged in data theft. That letter was dated Sept. 20.

In November the county finally decided to start notifying individuals whose information may have been compromised.

An email sent to county employees last month, Kelly indicated that it was a FOX 9 data practices request that prompted the disclosure that many might say was long overdue.

When FOX 9 asked a county spokesperson why people weren’t notified right away, they said they couldn’t share details because of the ongoing investigation. She simply said, “That didn’t transpire.”