Holmes County officials say flash drive with employee Social Security numbers recovered; commissioners seek identity-protection quotes and personnel changes

Holmes County commissioners were told on Oct. 12 that a public-records request produced a flash drive and files containing personal information, including Social Security numbers, for roughly 75 people and that the county has recovered the physical drives.

The matter arose after a public records request produced a collection of files that, commissioners said, included employee Social Security numbers, dates of birth and other personally identifying information going back several years. County staff said the county now has the flash drives and related files in its possession and that a separate county computer containing similar data remains with the Department of Financial Services under the terms of a search warrant.

County officials said they do not have evidence that data from the recovered drives has been published or widely disseminated outside the county, but they described the situation as a serious security incident that requires remediation and outreach to those affected.

Why it matters: the files include personally identifying data for employees and possibly former employees and beneficiaries, which can increase risk of identity theft and fraud. Commissioners directed staff to develop next steps — including procuring identity-protection services and tightening records procedures — to limit future exposure and to give affected people options for protection.

County response and next steps

Commissioners and staff said the physical flash drives that were circulated externally have been returned and are in county custody. Carol Kent, owner and publisher of the Holmes County Advertiser, told the commission that “the only person that accessed that information was me,” and said her paper had handled the drive under its normal practices before returning it to county staff.

Commissioners instructed county staff to obtain multiple written quotes for identity-protection services and to return the item to the agenda at the next meeting. At the meeting they put a specific procurement direction on the table: obtain at least three quotes for identity-protection packages (standard and “ultimate” options were discussed), clarify whether the pool to be covered will include only current employees or also past employees and listed beneficiaries, and report back with cost estimates and a recommended scope.

Personnel and policy changes

Commissioners also discussed strengthening the county’s records-custodian function. They agreed to amend the job posting for the project director/records-custodian role to emphasize public-records management and data-security responsibilities and to re-advertise the position; during debate a commissioner moved to set a top hourly rate of $20 for the hire. The board directed staff to pursue that personnel change and to include records-management duties in the job description.

Security controls and chain-of-custody concerns

Discussion centered on where the process broke down: speakers said a drive containing broad personnel information had been removed from a county computer and passed between people (including a local newspaper employee who picked up the drive at the requester’s direction). Commissioners and attendees repeatedly raised a need for a stronger chain-of-custody process when record copies are removed from county systems, for clearer redaction procedures and for technical controls such as firewall, server access restrictions and contractor access policies for Monarch Tech (the county’s IT contractor).

Notifying affected people

Staff distributed guidance materials (including Federal Trade Commission and IRS breach-notification recommendations, according to meeting materials) and discussed the need to identify precisely who is included on the files before making formal notifications. Commissioners emphasized that the county should budget for identity-protection services for those the county determines were affected, but they did not finalize a coverage list at the meeting.

Quotations and attributions

Carol Kent, owner and publisher of the Holmes County Advertiser, told the board that she reviewed the drive briefly and that she and one employee who transported the device did not retain copies: “the only person that accessed that information was me,” she said, and she said she returned the drive to county staff.

Process and legal context

Speakers referenced state public-records law and recommended following established redaction and notification procedures; meeting materials included sample notification language from the Federal Trade Commission. County counsel and staff discussed records-retention schedules and the need to identify which categories of records on the drive are subject to longer retention rules.

What the board directed

- Obtain at least three written quotes for identity-protection services and report back with costs and a recommended scope. - Clarify who will be offered any purchased identity-protection coverage (current employees, former employees, listed beneficiaries) and budget accordingly. - Amend and re-advertise the records-custodian/project-director job description to emphasize public-records management and data-security responsibilities and set the proposed top rate discussed during the meeting. - Secure and redaction-process the remaining files, preserve chain-of-custody documentation, and follow guidance from federal agencies on breach notification.

Ending

Commissioners said they plan to reconvene the item at the next meeting after staff obtains quotes and refines the list of affected individuals; they also said they will consider additional cybersecurity and contract changes for their IT vendor.