Attorney General Suing Over Data Loss

HARTFORD — Attorney General Richard Blumenthal announced September 19 that he is suing Accenture for illegal negligence, unauthorized use of state property, and breach of contract in connection with the loss of confidential information on 58 state taxpayers and hundreds of state bank accounts and purchasing cards.

Mr Blumenthal filed the action on behalf of state Comptroller Nancy Wyman, whose office contracted with Accenture. The lawsuit alleges that Accenture converted state property to its own use without state permission, acted negligently, and violated its state contract by allowing the highly sensitive data to be placed on a State of Ohio backup computer tape that was later stolen. The theft occurred in June, but Wyman’s office was not notified until September 4.

The tape included information on several hundred state agency bank accounts and 754 agency purchasing cards, 298 of which were active. Data on the tape is difficult to access, making it unlikely the thief will be able to view the information. There is no indication that any money was improperly withdrawn or of improper charges on the purchasing cards.

The comptroller’s office hired Accenture to help implement a new computer system.

The lawsuit seeks damages and reimbursement for state resources expended to protect and secure the information, as well as an order returning some money already paid the company.

“Accenture deserves censure — to be held accountable for allowing valuable secret data to be stolen and putting at risk state taxpayers, bank accounts, and purchasing cards,” Mr Blumenthal said. “Accenture acted unconscionably and illegally. It breached its commitment to keep confidential this highly sensitive financial information. The company broke its contractual promises and duty of care to safeguard the secrecy of sensitive data. It misappropriated state property, taking significant valuable data for its own use without permission or authority.”

The comptroller said she was able to analyze the tape and secure the data within a period of days by working with several state agencies in Connecticut and Ohio, banks, and credit-protection services.

“My first priority in this incident was to take whatever steps were needed to secure the data and protect the state and its taxpayers from any potential harm,” Ms Wyman said. “I am pleased to say that there is no indication that any of this data has been compromised in any fashion.”

Ms Wyman said Accenture must be held responsible for putting confidential information at risk in direct violation of its contract. The company has already agreed to pay for all costs of providing credit protection to the affected individuals.

Mr Blumenthal added: “We seek recovery of some of the money already paid, as well as all costs or damages present or future, and sanctions that send a message: We will not tolerate reckless failure to safeguard sensitive financial data. We paid Accenture to follow the rules. Its failure should have consequences.”