State admits to lapse in security of juror rolls
More than 620,000, including thousands in La Plata County, had birth dates, Social Security numbers accessible on site
About 15,000 La Plata County residents got some unsettling news in the mail recently. In an Aug. 14 letter from the Colorado Office of the State Court Administrator (a real thing), they were alerted that juror rolls containing their personal information, including birth date and Social Security number, was viewable on the internet during a year-long security lapse at the Colorado Judicial Department.
“Some of your personal information was inadvertently posted to one of the Colorado Judicial Department websites,” stated the letter. “The problem has been resolved. There is no indication your information has been misused or stolen,” the letter continued, saying it was sent out of an “abundance of caution.”
The state court administrator’s office was contacted July 27 by someone in Alaska who alerted it to the potential for identity theft, according to the Judicial Department.
About 621,000 names with corresponding Social Security numbers and dates of birth were exposed on the department’s internal intranet. According to the letter, most of the information could not be accessed via external search engine. However, about 41,000 were exposed externally, available to anyone on the internet. The externally exposed files were from Crowley, Pueblo, Rio Grande and Weld counties.
The information had been exposed since August 2016. Within 90 minutes of being alerted to the lapse, the administrator’s office shut down both internal and external access to all jury files.
“The information exposed was not the result of a malicious attack attempting to access Colorado Judicial files,” a CJD news release said.
Judicial Department spokesman Jon Sarche said data of up to 15,000 residents (numbers depend on each county’s population) in each of Colorado’s 64 counties was exposed. He did not know how many in La Plata County were affected. “I don’t have exact numbers for La Plata County beyond the fact it was less than about 15,000,” he said.
He also was not sure of the reason for the lag time between when state news outlets reported on the lapse – the Denver Post had a story on Aug. 9 – and when affected residents were notified.
“I can’t fully explain the lag time. I believe we used a state bulk-mailing service,” he said.
Every individual on the list of those exposed, internally and externally, were notified and given a list of credit reporting agencies in order to keep tabs on suspicious activities:
• Equifax: www.equifax.com; 1-800-525-6285
• Experian: www.experian.com; 1-888-397-3742
• TransUnion: www.transunion.com; 1-800-680-7289
“SCAO regrets this error and has taken the steps necessary to enhance the security of its intranet,” the letter, signed by Acting State Court Administrator Christopher Ryan, stated. He also added that those affected are asked not to contact their local courthouses, as staff there has no information on the breach, and instead call 720-625-5999 or email email@example.com.