Oklahoma City resident Joe Sills discovered more than 5,000 Social Security numbers after purchasing the server and other surplus state computer equipment at an auction last month.
Sills was testing the equipment recently when he found the data in a file on the server. He said he's outraged that the state didn't erase the server's memory.
"People's identities are at risk," he said.
The server had been used by the state Tax Commission and, most recently, the Corporation Commission.
The Social Security numbers are likely tied to trucking industry data kept on the server by both agencies, Corporation Commission spokesman Matt Skinner said.
Since the Corporation Commission is now removing hard drives from computer equipment it sends to state auctions, people who buy the equipment will have to provide their own hard drives, Skinner said. It will keep accidental sensitive information leaks from happening again, he said.
State policy requires sensitive information to be erased from surplus equipment before it is auctioned, state Department of Central Services spokeswoman Gerry Smedley said. Erasing sensitive data is the responsibility of the agencies that owned the equipment.