Data of 439 Claimants Contained on Stolen Laptop,
BWC Notifying Affected Employers and Injured Workers

Columbus, Ohio – The Ohio Bureau of Workers’ Compensation (BWC) announced today that a laptop computer was stolen from the home of a BWC employee. The computer contained some non-public, personal information of 439 injured workers.

“Securing the integrity of digital information is critically important no matter how many or how few individuals are affected,” said BWC Administrator Marsha Ryan. “The recent theft of a storage device and the executive order signed by Governor Ted Strickland heightened everyone’s sense of awareness about this important issue.”

The BWC is currently notifying both the employers and the claimants. Free identity protection service will be offered to the affected injured workers. The service will be provided by Debix and each affected injured worker will receive a letter with a specific PIN number and sign up instructions.

“While the information was password protected and did not contain financial data, it did include certain information such as claimant Social Security numbers,” said Ryan. “As a public institution, we must be more diligent in protecting the personal information contained on both internal and external digital devices.”

Claimant information was included on the stolen laptop computer because it belonged to a BWC auditor who reviews workers’ compensation programs for Ohio’s self-insured employers. These are large Ohio businesses that privately administer and manage their own workers’ compensation claims. BWC audits these programs to ensure integrity, which includes sampling and verifying individual claim information.

The stolen laptop computer contained data from audits performed at 24 employers. The data contained non-public information for 439 injured workers that included such information as a claimant’s name, claim number, date of injury, Social Security number, amount of workers’ compensation received, and possibly the medical diagnosis associated with the workplace injury.

“While we do not want to unduly alarm the hundreds of thousands of injured workers throughout Ohio who are not affected by this, we do want to make the public aware of this incident given the overall sense of concern throughout the state at this time,” said Ryan.

The timeline below will provide an overview of the event and the subsequent response:

• May 30, 2007. A laptop computer was reported stolen from the home of a BWC employee. The Columbus Police Department and the employee’s supervisor were notified.
• May 31, 2007. BWC notified the laptop manufacturer of the theft and submitted the serial number of the laptop computer to be entered into the database of stolen equipment.
• June 1, 2007. BWC Internal Affairs began investigating the matter and notified the Ohio Highway Patrol, as well as the Columbus Police Department.
• June 14, 2007. The Columbus Police Department provided its report to BWC security and IT.
• June 15, 2007.
• Governor Ted Strickland announced the theft of a separate electronic device and issued Executive Order 2007-013S, Improving State Agency Data Privacy and Security.
• BWC Administrator Marsha Ryan was notified by BWC personnel of the theft of BWC laptop computer.
• BWC Security and IT Security begin to review the information that was contained on the stolen laptop to determine if it included any potential non-public, sensitive information of employers or injured workers.
• June 18, 2007. A determination was made that the stolen laptop contained sensitive information that would have included certain non-public claimant information. An analysis and identification of the data began.
• June 19, 2007. BWC Administrator is notified that some non-public claimant data was contained on the stolen laptop. Development began of new policies and procedures to increase the safety and security of sensitive BWC data.
• June 22, 2007. An analysis of the missing laptop data is completed. It was determined that social security numbers of 439 injured workers were contained on the missing laptop. BWC began calling and notifying the employers of the affected injured workers.
• June 25, 2007. BWC is currently verifying the last known address of each affected injured worker. Once the address verification process is complete, BWC will send notification letters that will include the identity protection service offered through Debix. Letters to each injured worker should be sent before the end of the week.

# # #

Contact: 1-800-OHIOBWC or FeedbackMDS@bwc.state.oh.us