[BreachExchange] Wright County officials: Data breach impacted as many as 72, 000 people

[Destry Winant]

https://kstp.com/news/wright-county-officials-say-data-breach-impacted-as-many-as-72000-people/5180302/

Wright County Officials believe as many as 72,000 people were impacted
by a data breach involving one of their former employees.

That employee has since been fired, but this week, letters were sent
to those affected in the community.

According to the county, the employee was trained on protecting
citizen data and decided "to not follow policy."

When asked if he was responsible for taking the data, Lorsung
responded, "Yes, I wanted to work at home."

"I was an hourly employee so after so many hours they said you need to
go home," he added.

He stressed the data is safe, adding, "I didn't sell it, didn't do
anything to it, there's data in there I didn't even know I had."

Lorsung said he doesn't currently have any of the private data,
including social security numbers and financial records.

Many residents are concerned about the data breach, but some believe
the timing of informing the public shows a lack of transparency from
county leaders.

"I was surprised, more worried about the fact that my son's
information is floating out there as well," said Kim Williams-Dubois,
one of the 72,000 people impacted by this breach.

"It's mind-boggling. I didn't think I'd had to worry about it with the
county with a data breach," Williams-Dubois said. "You would think and
hope your information would be safe with them."

This week, the county sent a letter to all those affected. But 5
EYEWITNESS NEWS obtained a search warrant that specifically cites that
county officials knew about this data breach all the way back in
April.

"I think it's pretty ridiculous that I was just notified if it was in
April just because someone could have been out there and could have
had my information for eight months," Williams-Dubois said.

Wright County officials stress there's "no evidence" that there was
any "sale or distribution of the private data."

In regards to the timing of the release of the information to the
public, the county went on to say in a statement: "This case involved
numerous data bases and multiple computer systems that were reviewed
by computer forensic consultants to determine the scope of the breach
and determine the identities of the individuals affected. The multiple
data bases also meant that the County did not have addresses
associated with many of the individuals impacted, which then had to be
obtained before the notices could be sent out."

Lorsung has not been charged with anything, but Wright County
officials say there is an active criminal investigation underway.