Skip to main content

Security breach threatens soldiers', civilians' personal info

By Samantha Hayes, CNN
  • Employee's laptop containing personal data was stolen over holiday weekend
  • Army says data guarded by layers of security and encryption
  • Military sent letter to those affected two weeks after theft
  • Risk assessment forced lag in announcement, military says

WASHINGTON (CNN) -- The personal records of thousands of soldiers, employees and their families were potentially exposed after a laptop computer containing the information was stolen over the Thanksgiving holiday weekend, the military says.

But information security experts for the Army say it's unlikely that the information will be compromised because the data are guarded by three layers of security and encryption passwords.

The security breach happened when the rental apartment of an employee with the Morale, Welfare, and Recreation Academy was burglarized in Clermont, Florida, officials said. The theft was reported to local police November 28, but the military was not notified until the employee returned to work three days later.

Military officials say the employee was using the laptop for remote training courses, and it has not been determined whether any protocol was breached.

The computer contained "names and personally identifiable information for slightly more than 42,000 Fort Belvoir Morale, Welfare and Recreation patrons," according to a posting on the Web site for the fort, which is in Virginia.

CNN obtained the notification letter sent, almost two weeks later, to those affected. It says, in part, that the alleged compromised information "includes your name, Social Security number, home address, date of birth, encrypted credit card information, personal e-mail address, personal telephone numbers, and family member information."

The letter recommends steps to guard against the possibility of identity theft.

The military says the lag in notification time was because of a policy requiring risk assessment before alerting those affected.

The Family and Morale, Welfare, and Recreation Command operates facilities such as child care centers, bowling centers and outdoor recreation facilities. Those facilities are available to anyone with a military ID, which includes active-duty troops, Department of Defense civilians, family members and retirees.

This isn't the first time a missing laptop has resulted in a potential security breach for the military.

In 2006, a Veterans Affairs Department analyst lost a laptop computer that contained the Social Security numbers and other personal data for more than 26 million veterans and active duty troops.

That incident, in addition to other major data breaches, prompted a national call for protection of personal information. A bill currently under consideration in the Senate would put more protections in place.