E-problem puts library patrons' info on Internet

December 20, 2006

By Michael Buck, Chronicle Staff Writer


A technical problem on the Lakeland Library Cooperative Web site made available personal information of more than 15,000 patrons across West Michigan on the Internet.

Information that was displayed included names, phone numbers, e-mail addresses, street addresses and library card numbers of library patrons registered on the site.

Minors were also indicated on the spreadsheet type document by a listing of parents' names.

"(Our systems manager) thinks there was a software malfunction," said Martha McKee, interim director of the Lakeland Cooperative Library. "They fixed that, so the information is not accessible anymore."

The Lakeland Cooperative Library services Hackley, Muskegon County and White Lake Community libraries in Muskegon County and Spring Lake District Library and Loutit District Library in Grand Haven. The system spans out to Allegan, Barry, Ionia, Kent, Montcalm, Newaygo and Ottawa counties.

McKee said that everyone on the list will be notified of the breach and issued a new library card bar code sometime in the near future.

"I don't think anything bad will happen, but we need to be proactive," she said.

Christopher VanOosterhout, of Muskegon, uncovered the list on the Web site Monday evening while updating his library account to receive e-mail notifications.

Recognizing the Web page form used to create the site, VanOosterhout, an independent Internet commerce consultant, thought there may have been a problem with the system's security.

"I went to view source on my browser," he said. "I copied (the Web address) out of the source code and put it in my browser and that's when I saw the 15,000 names.

"I saw this and I said 'Oh, my gosh, I work with these people,' and then I saw that my wife was on it and thought 'Someone has to do something.' "

The Web address led VanOosterhout to where the information was being stored on the Internet.

"When you look at a Web site, there is public coding and private coding, and this was part of the public coding," he said. "It was there for the public to see."

Less than 24 hours after VanOosterhout alerted library officials to the problem, Lakeland Cooperative computer administrators secured the data.

"There could have been people who were looking at this information all along and using it for not-so-savory purposes," VanOosterhout said. "I'm just so pleased that they took care of it so quickly."

Neither McKee nor VanOosterhout could estimate how long the information was available for viewing on the Internet.

McKee said that the library last month underwent a software upgrade on their system, but was not able to determine if that was the source of the problem.

main page ATTRITION feedback