FAA says info on 45,000 workers stolen in data breach

Server break-in nets info on people who were on agency’s payroll in February 2006

February 10, 2009 (Computerworld) The Federal Aviation Administration disclosed yesterday that it is investigating a data breach in which the personal data of about 45,000 employees and retirees was apparently stolen from a server at the agency.

The compromise resulted from an intrusion into the system that was storing the data, the FAA said in a brief statement. There are no indications that any of the servers used for air traffic control or other operation systems were similarly broken into, the agency said, adding that it has contacted law enforcement authorities and will notify the affected individuals via mail.

According to the FAA, the server that was breached had a total of 48 files, two of which contained personal data on people who were on the agency’s employee rolls as of February 2006. But the FAA’s statement didn’t say when the breach might have happened or how and when it was discovered, and the agency has yet to respond to a request for further information about the incident.

“The FAA is moving quickly to prevent any similar incidents and has identified immediate steps as well as longer-term measures to further protect personal information,” the agency said in the statement. But again, it didn’t provide any details about the steps it plans to take.

A employee union official quoted in an Associated Press story that was posted online yesterday before the FAA’s disclosure said the other information on the breached server was encrypted medical information. He was also quoted as saying that FAA officials told the union the breach was the first of its kind at the agency.

However, the FAA is merely the latest in a long line of federal agencies to be hit by security breaches, either via system intrusions or the loss or theft of laptop PCs containing unencrypted data.

In the most serious incident thus far, the U.S. Department of Veterans Affairs reported in May 2006 that a laptop and hard drive containing the personal data of 26.5 million military veterans and active-duty personnel had been stolen from an employee’s home that month. The laptop and drive were recovered the following month, and VA officials said that the data on them appeared to have been untouched. But the incident sparked an overhaul of the VA’s IT department and security changes across the government.