The Boulder County Sheriff’s Office published the Social Security numbers of multiple inmates in the county jail on its website, CPR News learned on Tuesday.
The personal identifying information was included in daily lists of hundreds of inmates that are published on the sheriff’s website.
Emily Katsiyannis, who is on work release from the jail, confirmed that her full Social Security number was included next to her name. CPR News contacted Katsiyannis after finding her name on the list and verified the SSN belonged to her.
“I feel betrayed that they wouldn’t keep something so important safe,” she wrote in a text to CPR News. “It was something completely out of my control and … I trusted the jail with that info.”
A family member of another inmate first told CPR News about the data breach, confirming that his brother’s full SSN was listed in plain text.
The personal identifying information was included in a spreadsheet that is published daily with details about jail inmates.
The file included identifying numbers in the common SSN style — for example, “123-45-6789” — for a total of 16 inmates. More than 400 other inmates also had nine-digit numbers associated with their names, except without dashes — for example, “123456789.” More than 150 of those numbers fell in the range of SSNs associated with people born to Colorado parents.
CPR News could not confirm how many of the numbers actually were Social Security numbers. The information appeared on the inmate lists for several days reviewed by CPR News, including Dec. 15, Dec. 18 and Dec. 19.
CPR News contacted the Boulder County Sheriff’s Office about the personal identifying information just before 1 p.m. on Tuesday. Within 90 minutes, the information had been deleted from the online lists.
The sheriff's office released a statement on the leak on Tuesday evening: "We sincerely apologize to everyone that was affected and will diligently work to ensure that this never takes place again."
The accidental release began after a glitch crashed the daily report system on Dec. 15, the office reported. When the system was restarted, someone configured it incorrectly, resulting in the SSNs being published, according to the sheriff's office.
The Social Security numbers were included in a spreadsheet column titled “Charges,” which normally includes information about the criminal charges a person faces.
"In order to get the listing up and operational again, the data was re-exported. When the query was rebuilt for the historical excel export, an incorrect field was selected for the charge field that contained the social security number," the statement read.
The statement continued: "Going forward, our IT staff will run a review daily to ensure that the information on our online jail reports does not include any information that isn’t public data. We are also working to notify the affected inmates and assist them in protecting their credit."
Janene McCabe, a criminal defense attorney and the vice president of the Colorado Criminal Defense Bar, said her reaction to the breach was “shock and dismay.”
She added: “We go to great lengths to protect inmates’ information … and here the jail is posting it publicly — an entity that is tasked with keeping our clients’ privacy rights safe from public view.”
McCabe said she’s seen individual cases where a defendant’s identifying information is accidentally included in forms, but never one that potentially affects hundreds of people.
Katsiyannis wondered whether the jail would provide her with access to a consumer identity protection service, as companies often do when they suffer a data breach. McCabe agreed the county owed that much to people affected, since the leaked SSNs could be used by identity thieves.
“One, they need to let everyone know whose Social Security numbers were publicly leaked. No. 2, I think they have an obligation to provide some sort of protection for these clients,” she said. “They have no idea that their public information is out there, that it’s been leaked."
The sheriff's office has promised to help people's credit, but hasn't decided how to do so, a spokesperson told CPR News.
Editor's note: This article was updated on Dec. 20, 2022 with comment from the Boulder County Sheriff's Office.
