As details emerge about major Vermont data breach, governor’s office steps in

MONTPELIER — Vermont Gov. Phil Scott stepped into the widening information void formed by a huge state Department of Labor data breach on Wednesday, appointing a deputy commissioner to the department and deploying a team to help with the immediate response.

Scott also asked the state auditor, Doug Hoffer, to audit the department to find out how the error occurred and identify long-term quality improvements.

Meanwhile, state lawmakers and the labor department itself are discussing an investigation of the mistakes that led to the release of personal information on misprinted 1099-G tax forms, including Social Security numbers.

“We want to make sure that we understand what exactly happened, and it doesn’t happen again,” said House Speaker Jill Krowinski, D-Burlington, at a press briefing Wednesday. “As we get more information, we’ll be able to decide what path makes sense for an investigation.”

Lawmakers planned to meet Thursday with the governor’s office and Hoffer, said Sen. Michael Sirotkin, D-Chittenden.

At a hearing Wednesday before the Senate Committee on Economic Development, Housing and General Affairs, Labor Commissioner Mike Harrington scaled back earlier estimates of how many people might have been affected by the data breach, which occurred after the department mailed out some of the tax forms Friday and Saturday.

The labor department printed out 180,000 1099s to send to unemployment insurance recipients this month. But most of the forms hadn’t been mailed yet, and many Vermonters will receive more than one form because they used more than one labor department program during the COVID-19 crisis. In an email Tuesday, the department asked anyone who received a 1099 this week to return it.

Harrington said about 2,000 of the faulty 1099s have already been returned, either by post offices after staff members noticed the names didn’t match the addresses or by people who opened their returns and saw someone else’s information.

Lawmakers pressed Harrington on Wednesday morning — before the governor’s announcement — to do a better job of communicating with the thousands of Vermonters who have received the faulty 1099 forms. Vermonters are receiving an array of tax notifications at this time of year and will eventually receive new, corrected 1099s from the labor department. Meanwhile, they’re being asked to mail back all of the ones mailed out last week.

Sirotkin, who is chairman of the Senate Economic Development Committee, suggested the department run its letters by advocacy groups or others who can make sure the language is understandable “and doesn’t get wrapped up in bureaucratic things and covering your rear end in all the legal requirements in what you have to say,” Sirotkin said.

“I’ve seen that over and over again, unfortunately, in my very lengthy career,” Sirotkin said. “Advocacy groups look at letters that come out of the administration and can’t believe that kind of letter has been sent by a governmental official. It almost thwarts the purpose of what you are trying to achieve because it gets people so confused.”

When the COVID-19 crisis hit nationally, and in Vermont, state labor departments became the payment mechanisms chosen by the federal government to get emergency money out to newly unemployed Vermonters as quickly as possible.

The Vermont Department of Labor, which normally processes about 6,000 claims a week, saw its volume of claims rise to as high as 90,000 in the spring. Although it hired a contractor and brought in other state agencies to help, the department suffered from hourslong phone backlogs and an array of problems, including another data breach, also involving Social Security numbers, that happened in May.

In the most recent crisis, the labor department is still in the early stages of response mode, assessing what happened and how many people were affected.

The department is now working on the assumption that as few as 25,000 people or as many as 44,800 people were affected, Harrington said. That’s based in part on responses the department has been receiving since the tax forms started arriving in people’s mailboxes with the wrong information in them on Monday.

Based on reports from unemployment insurance recipients, the errors appear to be limited to people who received 1099 forms for two unemployment insurance programs: The Lost Wages Assistance program and the Vermont Short Term Supplemental Benefit program, Harrington said.

He said the department is looking for a company that can work with anyone who does experience identity theft as a result of the breach.

Scott said Wednesday that the newly created response coordination team will help recover the faulty 1099 forms, deliver the correct forms in a timely manner, and improve the labor department’s communication with Vermonters and legislators. That team includes Brittney Wilson, Scott’s deputy chief of staff; Douglas Farnham, chief of operations at the Agency of Administration; and Shawn Nailor, deputy secretary at the Agency of Digital Services.

“State agencies and departments have a responsibility to Vermonters to deliver excellent service and to safeguard their information,” Scott said in a prepared statement. “This incident does not meet those standards, and we must do all we can to make this right for Vermonters.”

On Wednesday, Sen. Randy Brock, R-St. Albans, told Harrington it appeared the department’s antiquated mainframe was partly to blame for the error.

“Transmission of data from a mainframe to an Excel spreadsheet that is then manipulated: That is probably one of the top, if not the top, causes of failure that folks see in financial audits,” said Brock, an accountant who is a former state auditor. “It’s a real danger signal.”

Harrington said some blame rested not with the mainframe itself but with the labor department’s outdated systems.

“The fact that we are now shuffling data from multiple programs and processes and having to do much of it in a manual fashion instead of an automated fashion increased the opportunity for the error to occur,” he said.

The breach happened with a row of cells in the spreadsheet that was moved.

In many cases, unemployment insurance claimants received mail marked with their first name and address and someone else’s last name. Inside, they found an incorrect Social Security number.

Robert Bliss, of Brattleboro, tried to track down the person whose last name was on his tax form, reasoning that this might be the individual who received Bliss’ Social Security number in error. In an online search, he found a newspaper story about one of them, a young man who had recently been arrested.

“All the others were more elderly than me, so I’m hoping it’s one of them,” said Bliss, who is 68.

Bliss noted that he’s a recipient of the Pandemic Unemployment Assistance program. The labor department has said other programs appear to have been affected.

“It was definitely PUA,” Bliss said. He added that he’d like the labor department to provide the name and address of the person who got his Social Security number.

“I’m going to go find this person and say, ‘Did you send it back unopened?’ ” he said.

Ryan Kriger, an assistant attorney general in the consumer protection division of the state Attorney General’s Office, said anyone worried that their Social Security number might be misused should put in a credit freeze through the three credit reporting agencies. That service is free.

“Freezing your credit reports is the single most effective way you can protect yourself,” he said. “That means no one can open up a loan account in your name.”

He added that everyone, not just unemployment insurance recipients, should be checking their accounts for unfamiliar charges and monitoring their credit reports carefully.

“It’s a really unfortunate thing, but all Vermonters should assume their Social Security number has been acquired by someone in some context,” he said. “Data breaches have become so ubiquitous.”

What to do if your 1099 has issues

If you receive a 1099 with a mismatched name and address on the envelope, or if the information on the form doesn’t match the information on the envelope, sit tight. The state will provide instructions for returning the incorrect form.

The state will mail a new 1099 to all unemployment claimants.

The state will provide instructions for identity protection to anyone whose personal information was potentially released.

In the meantime, monitor your bank and credit card accounts for any unauthorized activity. If you believe your identity may be stolen, contact Experian, Transunion and Equifax to freeze your credit score, or file an identity theft report at IdentityTheft.gov or USA.gov. All are free of charge.

Source: Vermont Department of Labor