VTDigger posts regular coronavirus updates on this page. You can also subscribe here for daily coronavirus news. Please send your Covid-19 questions to coronavirus@vtdigger.org
The Vermont Department of Labor accidentally mailed unemployment insurance claimants’ Social Security numbers to Vermont employers who weren’t connected to their cases.
One claimant has already seen what appears to be a fraudulent credit application using the number.
“This is not some random person,” said a southern Vermont woman whose husband received a May 14 letter informing him the DOL had mailed out his number “to an employer that was not associated with your unemployment claim.”
The woman asked not to be identified because she is worried that the person who misused the Social Security number can find her. She said her husband received a letter from a credit card provider on May 12 saying that his application for credit had been denied. He hadn’t applied for credit. On May 15, the pair received a letter from DOL informing them that due to a processing error – and not a data breach from an external source – his Social Security number “may have inadvertently sent” to an employer not associated with his case.
The error happened on March 30 as part of a 5,667-piece mailing notifying employers that individuals had filed claims. The two-sided form was supposed to have the relevant employee’s information on the back of the letter, but instead it had the information from another employee, said Dirk Anderson, general counsel for the Vermont Department of Labor. An employer called them on April 1 to let them know, Anderson said.
He couldn’t explain why it took the department until May 14 to notify the 5,667 claimants that their Social Security numbers might have gone to the wrong place, though he noted that the DOL has 45 days under the law to notify individuals affected by that kind of information release. The DOL wrote to employers April 25 to let them know.
“We were just trying to get our heads around the scope of this thing,” said Anderson.
The mainframe computer that generated the letters was operated by the Agency of Digital Services, which is working with the DOL.
The DOL has been in crisis since the governor in late March closed businesses to limit the spread of the Covid-19 virus. More than 90,000 people have applied for unemployment since then, including many applying through a new program for the self-employed. The DOL has been under fire for weeks over customer service problems and missing payments.
It recently notified claimants it had accidentally paid out the $600 federal unemployment benefit to 8,000 claimants for weeks before it was supposed to go into effect. And in April, a DOL call center employee accidentally gave out a claimant’s phone number to others as the number to call for further assistance.
Since the crisis began, the DOL has added hundreds of employees to answer phones, and is still getting thousands of calls every day, with an answer rate of about 75%.
“We were consulting with the Attorney General’s office … and we were in the middle of this full-blown other crisis,” said Anderson of the delay in notifying claimants their SSNs might have gone to the wrong employer. “And yes, it probably should have happened sooner.”
Tom Buchanan of Londonderry, who also received a letter about the Social Security numbers from the DOL, said May 19 that he was disappointed he wasn’t told him how big the breach was.
“From the way the letter was written, I assumed that letter went to the wrong ski area,” said Buchanan, who teaches skiing and snowboarding at Okemo in the winter and works as a fly-fishing teacher and guide at Orvis in Manchester in the summer. “I assumed it was a simple mistake like that, and that there weren’t so many employers involved.”
“I would generally trust Vermont employers, particularly if they are large employers,” Buchanan said. “But when you get into hundreds of small employers, who knows what might happen?”
For the woman in southern Vermont whose husband’s SSN was released, the fact that someone at a Vermont company apparently used the number to try to file a credit card application makes the incident more troubling.
“This was sent directly to a company, and some employee did this,” she said. “And I just find that astounding.”
It also makes her feel unsafe revealing her name or the name of the credit card company that wrote to turn down the fraudulent application.
“We don’t know what this person has done with his identity,” she said. “Did they sell it, did they get shut down and just destroy his information? We’re concerned about repercussions. This person could be in my town. They could drive by my house.”
The print run included mailings to employers with two or more layoffs, said Anderson, meaning it’s possible not every single SSN was sent to the wrong place. But the DOL can’t know for sure, and that’s why the letter says “may have inadvertently been sent.”
Anderson declined to name the companies that received the wrong Social Security numbers. The DOL’s letter to the claimants said there was no evidence the information had been misused, and includes a list of resources they can use to protect themselves from identity theft.
“Really?” said the woman in southern Vermont. “How do you know?” She thinks the DOL should have done more to help. She and her husband called the police.
“There is no offer to help with monitoring,” she said. “It’s just, ‘By the way, here are some contacts for credit agencies, reach out to them; good luck.’”
Get the latest statistics and live updates on our coronavirus page.
Sign up for our coronavirus email list.
Tell us your story or give feedback at coronavirus@vtdigger.org.
Support our nonprofit journalism with a donation.
