Members' Data Lost at DC 37; ID Theft Risk

By GINGER ADAMS OTIS

Thirty-two thousand members of District Council 37's Health and Security Plan got letters last month warning them that a disc containing their names and Social Security numbers had been lost, leaving them vulnerable to possible identity theft.

The Chief-Leader/Pat Arnow THOMAS EPPINGER: Monitor credit for free.

According to a letter sent to an Emergency Medical Service worker on Jan. 19, the data was held on a CD used to fill prescription drug requests between Feb. 13 and 26 last year.

Some Retirees At Risk

The affected members are a mix of retirees and active workers from all DC 37 locals. The Health and Security Plan has more than 171,000 participants, but only the 32,000 whose personal information was on the disk are at risk.

It wasn't clear from the letter when the CD was lost. Officials realized it was missing in December, sources said, and immediately took steps to inform members.

"While there is absolutely no evidence to suggest that your personal information has been accessed or misused, the Plan is advising you [ ... ] that a CD containing your name, Social Security number and prescription drug(s) filled for you ... is missing," the letter said.

It encouraged members to place a "fraud alert" on credit card files by calling the three major credit bureau companies, and listed the companies' names and telephone numbers. It also recommended contacting the Federal Trade Commission's Web site on identity theft, and provided similar state Web sites for New York and Florida.

Lost on Premises?

The letter instructed members to use DC 37's Municipal Employees Legal Services Consumer Litigation Unit if any evidence of fraud appeared. It also provided a number for the Health and Security Plan's lawyer, although an operator there said questions or complaints about the missing data would have to be mailed to Audrey Browne, Director of Regulatory Compliance and Contract Procurement.

Several sources declined to speak on the record about the incident, but said that it appeared the CD had been lost in-house, not stolen or taken off-premises.

"We haven't heard a single complaint from members, so it would appear that nobody has the information and is trying to use it," said one source. "The Plan did the right thing by notifying everyone, however, even though the risk of fraud seems low."

But Thomas Eppinger, president of DC 37 Local 3621, which represents EMS officers, said the letter "was not sufficient."

Law Dept. Did More

When the city's Law Department last summer lost a laptop computer that may have contained some personal data of public employees applying for benefits through New York's Special Disabilities Fund, the agency sent letters alerting them to the security breach.

The agency also enrolled every worker in a complimentary credit-monitoring program for a year, Mr. Eppinger noted.

The service watched all three credit bureaus for potentially illegal activity on clients' accounts, provided $25,000 in identity theft insurance, and assigned a Fraud Resolution Representative to help with gathering documents, preparing legal claims and other steps in case fraud occurred.

The Law Department said in its letter that it had no indication "your information has been misused ... however, since your personal information may have been exposed, we are taking [these precautions.]"

System's Vulnerability

Mr. Eppinger called upon DC 37 to implement stronger security measures. He said Social Security numbers were too often used as a form of identification on paperwork in some DC 37 departments.

A DC 37 spokeswoman, however, said that members hadn't been identified by Social Security numbers since July 2006. The organization created special ID numbers to be used from then on. The only reason the lost disc still had Social Security numbers, she said, was that it had been created before the switch.

But Mr. Eppinger said Social Security numbers came on membership lists and were often requested by operators manning DC 37 phones in the legal division.

He acknowledged that DC 37 had offered the services of its legal department in the letter, but he said he doubted MELS could handle the workload if many members ended up in legal quandaries over the lost data. He also noted that MELS is only available to DC 37 members living within a 50-mile radius of the city.

"DC 37 should be getting a company that will monitor the workers' credit and provide it free of charge," he said. "It's not the mistake of the members, it's the mistake of DC 37, and there's a lot of people who make a lot of money there. Divert some of it this way to help those who don't make a lot, and who could suffer a financial disaster as a result of this."