The city’s Office of Public Integrity is investigating why the procedure for handling tax forms was not followed, which led possibly to at least a half-dozen employees potentially viewing personal information of their colleagues.
City Communications Director Justin Roj said Friday afternoon that the city does not believe the information on the W-2 and 1099 forms was used in identity theft or for other nefarious purposes. Nevertheless, the city will be offering free credit monitoring for two years to the 3,000 to 4,000 employees and vendors who were affected.
Roj said it’s standard practice to offer credit monitoring after a data breach. The cost to taxpayers of that monitoring has not been determined.
The city learned Thursday of a lapse in the protocol for sending the files to the employee in charge of printing the forms to be mailed to employees and vendors, Roj said. The files were sent Wednesday.
The policy is to put the information on a thumb drive and hand the drive to the employee responsible for printing the forms. Instead, the information was put in a folder on a shared drive, which can be accessed by all city employees. Even though the folder had the name of the only employee who was to open it, Roj said six other employees opened the folder.
Roj said the employees who looked at the file were identified by user ID. He said those employees have been suspended with pay, pending the outcome of the investigation.
“We don’t know if folks looked at their own, did they go in and look at colleagues (forms),” Roj said. “We have reason to believe some folks went in and opened all the files.”
The city wrote in a news release that the Office of Public Integrity would refer evidence of criminal wrongdoing to the Rochester Police Department.
Employees or vendors who have questions or concerns can call the Department of Human Resource Management at (585) 428-7115.