The Oakland Unified School District abandoned its dilapidated headquarters in January 2013 after a janitor left a faucet on overnight and flooded the building. Educators departed and the homeless moved in, but no one bothered to remove or secure records that were scattered throughout the building.
The folly of that oversight became apparent this month when district officials revealed that five employees have been victims of identity theft and notified all employees (pdf) that their personal information may have been compromised.
“We want to err on the side of trying to make amends for this incident,” district spokesman Troy Flint told the Oakland Tribune, which is not quite the same as erring on the side of security.
The building contained 80 years worth of files, including W2s, payroll sheets, employment records and confidential files, and removal wasn’t really going anywhere. “Nobody really knew what was there, where it was hidden, or to whom it belonged,” Flint said.
Dan Noyes, a reporter for ABC News, wandered around the building last week, speaking to some of its current illegal residents, about the piles of records visibly stacked and unsecured. “I found the area where the district kept its payroll records; boxes and boxes of documents are still there,” he wrote.
One of the victims, district carpenter Deryl Hodges, told Noyes someone emptied his checking account of $1,500 two weeks before. Some of the victims reported credit cards taken out in their names and inquiries made into their retirement accounts. All five initial victims are carpenters.
Although the initial focus has been on employee records, Noyes said he found student information—including their addresses, birth dates and social security numbers—in the building. The district disputed that in its warning letter: “Contrary to media reports, student records were not compromised. The only documents related to students that remained in the building were financial documents for a small number of students who served as District interns.”
After the story broke, the district stationed security guards at the building and hired a company to box up the records and move them elsewhere. Employees are being offered two free years of identity protection services. The district apologized for the mistake.