Adams County officials say data connected to more than a quarter of a million people may have been exposed over a five-year period in a breach of the county’s computer systems.
The breach was revealed March 28 during a system-wide network audit, which revealed suspicious activity by an internal system user. The county’s auditing firm, Schenck, delivered a report June 29 detailing that personal identification, personal health information and tax information of about 258,000 people had been at risk between Jan. 1, 2013 and March 28, 2018.
“We believe that we secured the network to the extent that the continued exposure is not possible,” Adams County Manager and Administrative Coordinator Casey Bradley said Friday. “We have utilized a number of different steps and a couple different consultants to get there, and obviously we are cooperating with law enforcement in their investigation as well.”
Schenck, an accounting, financial and IT firm that has worked with Adams County previously, proposed the IT audit, which identified the red flags in the way the systems had been used.
Bradley said the Wisconsin Division of Criminal Investigation is pursuing an investigation. County officials say suspects have been identified and evidence so far suggests that although a great deal of data was compromised, there has not been any direct malfeasance involving that data or identity theft.
“We haven’t found any external breach that the data was used outside the network,” Bradley said. “If we have that, then it is treated differently.”
While Adams is a rural county with a population of just under 20,000, data sharing among various departments, particularly health and human services, put the information of far more residents at risk.
Adams County departments were asked to estimate their number of at-risk records, and health and human services put its number at 160,500, the sheriff’s office at 79,000, solid waste department at 8,000, child support at 6,200, veterans services at 3,800, county employees at 535 and University of Wisconsin Extension at 86.
“The bulk of that being Health and Human Services and that is because we are in a number of consortiums,” Bradley said. “People may call into their county of residence and end up speaking to an Adams County employee who helps them and essentially their records pass through our network, and that’s how the number got so high.”
During the investigation, the county has been unable to confirm the addresses of at least 10 people in the system, leading the county to issue a statewide data breach notice. Anyone with information that may be at risk is asked to verify the security of their accounts.
Bradley said people concerned about the security of their personal information should monitor their credit reports and be vigilant in checking their financial accounts.
Representatives from the state Division of Criminal Investigation did not respond to requests for comment.