A vendor for McHenry County College mistakenly sent personal identification information to other junior colleges.

Advocate Medical Group admitted that over 4 million files on laptop computers containing personal information were stolen.

Target admitted that 40 million of its customers had their identities stolen.  Then the number was 110 million.

But MCC refused to release the total number of people who had their identities compromised.

Here is the excuse used by MCC to hide the information:

“The College has redacted certain documents containing information about the number of persons affected by the data release, as that information is prohibited from disclosure by the Illinois Personal information Protection Act, 815 ILCS 530/10(a).”

I got the idea of asking for documents concerning postage used to mail the letters.

That request brought an answer showing the letters were sent by bulk mail and cost $4,700.

Let’s assume the college would use the cheapest postage rate, which was 13.5 cents apiece for carrier route sorted mail having a required minimum per route (3.5 cents more if the minimum is not met).

Dividing $4,700 by 13.5 cents yields 34,814.8.

So, 34,814 is the probably maximum number of people affected by the potential identity theft problem.

I informed the college of that figure and invited them to provide the correct number.

None came so I filed an appeal of the withholding of the number with the Illinois Attorney General’s Public Access Bureau.

The reply, dated March 4, 2014, arrived today.

Here is the conclusion of the opinion letter from Steve Silverman, Assistant Bureau Chief of the Public Access Bureau:

“In this instance, the plain language of PIPA describes what can and cannot be included in the letter of notification that is required under the Act. Section 10( a) prohibits inclusion of the total number of persons affected by a data security breach only in the letter of notification that is required to be sent to affected persons.

“It does not restrict disclosure of such information in any other circumstances.

“Accordingly, this office concludes that the College has not sustained its burden of demonstrating that the records in question are exempt from disclosure pursuant to section 7( 1)( a) of FOIA. The College is directed to provide Mr. Skinner with an unredacted copy of the invoice.

“The Public Access Counselor has determined that resolution of this matter does not require the issuance of a binding opinion.”

Articles you might find interesting:

• 8-9-14 McHenry County College Software Vendor Ellucian Sends Student Social Security Numbers to Three Junior Colleges
• 8-10-14 McHenry County College Faculty Personal Information Breached, Too
• 8-26-13 Different Approaches to Computer Security Breaches – Advocate Group and McHenry County College
• 9-11-2003 Closing In on the Number Involved in McHenry County College Security Security Number Breach