ALAMEDA, Calif. (CN) - A computer holding 20,539 Kaiser employee Social Security numbers was sold at a thrift store, California's attorney general claims in a complaint filed in Alameda County Superior Court, Friday.
Attorney General Kamala D. Harris, on behalf of the people of California, sued Kaiser Foundation Health Plan, Inc. for unfair competition, due to its breach of system security and failure to disclose the breach in a timely manner.
Sept. 24, 2011, Kaiser learned that a member of the public had purchased "an external hard drive containing unencrypted personal information of former and current Kaiser employees" at a thrift store in Santa Cruz, the complaint states.
The hard drive included names, Social Security numbers, dates of birth, and addresses, plus "unencrypted personal information of some employees' spouses and children," according to the complaint.
Kaiser was able to acquire the hard drive about Dec. 21, 2011, and conducted an initial forensic examination until about Dec. 28, 2011, the complaint states.
The examination revealed that 30,000 Social Security numbers and other employee-related sensitive information had been loaded into the drive, according to the complaint.
Kaiser waited to notify affected individuals until March 19, 2012, however, when it mailed letters notifying 20,539 Californians of the breach, the attorney general alleges.
Kaiser had inventoried the remaining contents of the drive until mid-February 2012, and "had sufficient information to identify and notify at least some individuals affected" between December 2011 and February 2012, according to the attorney general.
Harris accuses defendant Kaiser of failing to disclose a breach of system security "in the most expedient time possible and without unreasonable delay," as required by California law. She also accuses Kaiser of "displaying the Social Security numbers of 20,539 Californians" by providing the hard drive to a thrift store to be sold.
Harris seeks civil penalties and for Kaiser to be permanently enjoined from committing any acts of unfair competition, including the violations alleged.
Supervising Deputy Attorney General Adam Miller filed the complaint.