County Mistakenly Posts Personal Taxpayer Info Online

November 27, 2006

By Mike Charbonneau and Matthew Burns

SMITHFIELD, N.C. -- Johnston County officials recently posted personal information for thousands of residents, including Social Security numbers, on the county Web site by mistake.

A resident discovered the information by searching his own address on the Google search engine. In addition to seeing his own Social Security number online, the man, who wanted to remain anonymous, said he found another man's name, address, Social Security number and information that he was retired.

When the man clicked on a link, he said it took him to the Johnston County Web site, where tax office files contained thousands of other names and identifying information.

"That contains more information that folks would want out there -- cell phone numbers, in some cases I think, Social Security numbers," County Manager Rick Hester said, adding that the information was taken off the county Web site within an hour of officials learning about it.

County technology officials said the names are part of an annual list the tax office puts together for financial institutions. The personal information ended up in the file by mistake and might have been online for five or six weeks, officials said.

Hester said there was something peculiar about the man's address that pulled the information through Google.

"I still think it was only accessible by certain ways and certain information people put in there," he said. "I'm so glad it was brought to our attention because when we have problems like that its our responsibility to get to the bottom of it."

No one has reported identity theft resulting from the mistake, and county officials said they hope that means they caught the problem early enough. But Hester encouraged people to check their crdit reports in the near future.

Although North Carolina recently enacted a wide-ranging identity theft protection act requiring state agencies to report security breaches that could put people at risk, Johnston County isn't required by law to notify the people whose personal information ended up in the public domain.

main page ATTRITION feedback