A legislator urged the Ways and Means Committee on Aug. 14 to secure documents and protections after a data breach involving the county vendor Alara Group, saying county employees and retirees had received multiple breach notices and requesting a forensic report, timelines and stronger remedial measures.

The legislator told the committee they had received multiple letters and had heard of employees receiving many more notices, and asked whether the county had retained outside counsel to assess liability and whether the county was negotiating longer monitoring or additional protections beyond the vendor's initial two years of offered credit monitoring. The legislator said they would submit a written request for a full copy of the vendor's forensic report and a written plan from the personnel office and the county executive detailing protections for affected employees and a review of similar vendor contracts.

Controller Gallagher told the committee the controller's office had issued a memorandum to the county executive and legislative chair with observations and recommendations about the Alara breach and that the memorandum identified issues raised by the legislator. The controller offered to answer questions and said the controller's office would continue to work with personnel and executive offices.

No formal committee vote or directive adopting specific remedial measures was recorded during the meeting. The legislator signaled they would send formal written questions requesting documents and plans.

Context: the committee has oversight responsibilities that include personnel and vendor oversight; the meeting record shows concern among legislators about vendor notification timelines, subcontractor access to data (so-called fourth parties), and whether existing contract controls are adequate.

Next steps: staff were asked to provide documents and the legislator filed a promise to submit written questions; the controller's memorandum is already on file with the executive and legislative chair, per remarks to the committee.