Disaster victims' sensitive information exposed through FEMA data breach

The breach shared more than 20 different and unnecessary data fields with an unnamed contractor tied to the disaster agency

Outside shot of FEMA headquarters

America's Federal Emergency Management Agency (FEMA) has leaked personal addresses and banking information of 2.3 million disaster survivors in a data breach.

The agency leaked records of people affected by Hurricanes Irma, Harvey and Maria from 2017 to an unnamed outside contractor. It's common practice for the agency to share data with outside contractors, however, "FEMA provided more information than was necessary," said Lizzie Litzow, press secretary for FEMA.

The security breach occurred because of an error in a program used to place victims of disasters in temporary housing, according to the findings of the Office of the Inspector General.

Advertisement - Article continues below

The unnecessarily shared data included home addresses, birth dates and in most cases sensitive details about banking accounts belonging to the victims.

The breach could threaten the survivors with identity theft and fraud, according to the original watchdog report.

'Since the discovery of this issue, FEMA has taken aggressive measures to correct this error," said Litzow. "FEMA is no longer sharing unnecessary data with the contractor and has conducted a detailed review of the contractor's information system."

"FEMA has also worked with the contractor to remove the unnecessary data from the system and updated its contract to ensure compliance with Department of Homeland Security (DHS) cybersecurity and information-sharing standards," she added.

Advertisement
Advertisement - Article continues below

The Inspector General's report told FEMA it needs to install controls to ensure that the data would not continue to be shared with the contractor in question and also be certain that information shared is wiped from the contractor's systems.

Advertisement - Article continues below

"One can see how best practices in how a data leakage should be handled - notify the general public, have an action plan to resolve the issue and next steps what to do to not repeat the same mistake," said Boris Cipot, senior security engineer at Synopsys. "However, it also shows how bad decisions in database structures can lead to such disasters."

"When handling sensitive data, special care and a lot of thought has to be given to selecting which data can be accessed and which should not be accessible by systems. As said, it is good that they will now go and remove data that should not be shared, but this could be avoided if this selection was made earlier."

The report was originally published on 15 March but only recently came to light.

Of the 2.3 million people affected, 1.8 million had their bank details leaked with a further 725,000 had just their home addresses leaked, according to a Department of Homeland Security official who commented under the condition of anonymity.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/software/video-conferencing/355138/zoom-beaming-ios-user-data-to-facebook-for-targeted-ads
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/mobile/mobile-phones/355088/apple-lifts-iphone-purchase-restrictions
Mobile Phones

Apple lifts iPhone purchase restrictions

23 Mar 2020