Top News

St. Paul (AP) ― State tax officials disclosed Wednesday that a package containing private information on 50,000 taxpayers -- mostly businesses being audited for back taxes -- has been missing for more than a month.

The server backup tape contained Social Security numbers and other information for 2,400 individual taxpayers and identifying information on 48,000 businesses. The tape was sent in a package along with three checks totaling $2,400 and some interoffice correspondence.

An employee at a regional state Revenue Department office in Brainerd sent the parcel by certified mail from a contract postal station in Baxter on May 16. Department employees noticed the checks hadn't been posted on June 13, and realized the package had disappeared.

Both the Revenue Department and U.S. Postal Service are investigating.

Revenue Commissioner Dan Salomone said there's no indication the information on the tape has fallen into the wrong hands and is being misused.

Steve Kraatz, the department's acting chief information officer, said it would take about $50,000 worth of equipment, software and licenses to use the tape, which is also protected by a secret code.

However, the tape's data wasn't encrypted.

"We are confident that even if there are any bad actors involved here and they get a hold of that tape, they're not going to be able to very easily read it," Salomone said.

He added: "This is a nightmare for me that this happened."

Identify theft is a growing concern after high-profile government losses, including personal data on 17.5 million veterans and soldiers stolen from a U.S. Veterans Affairs employee's laptop.

Earlier this month, three laptops containing private data on municipal employees and some government aid recipients were stolen from the office of State Auditor Pat Anderson.

Last year, the Department of Public Safety shut down a license tab renewal Web site for almost nine months after discovering security breaches.

There have been two other leaks in data security at the Department of Revenue since last November: A flash drive was stolen along with an employee's purse, and a laptop was taken from a field auditor's residence. Both thefts involved data on businesses and apparently didn't result in misuse of the information.

Data security experts said a tech-savvy person could access the information on the server backup tape.

"If the normal Joe on the street would pick up that tape, they wouldn't know what to do with it," said Scott Larson, a former FBI agent who works for Stroz Friedberg LLC, a computer forensics firm with offices in Minneapolis. "It really depends on the level and skill level and determination and resources of an individual or an
entity that wants to gain access."

Revenue officials are encouraging those affected by the tape's loss to obtain free credit reports, monitor their accounts regularly and put a freeze on new credit applications by contacting their banks and credit reporting bureaus.

Letters to affected individual taxpayers are in the mail, and businesses will be notified by early July. Revenue Department spokesman James Zwilling said the companies involved range from one-person operations to large corporations.

Salomone said the department may provide additional help to
affected taxpayers.

The incident prompted Democrats to criticize Gov. Tim Pawlenty's administration for how it handles data security.

"We need to have stringent protocols regulating the way collected data is handled," said Rep. Jim Davnie of Minneapolis, who pushed for a state law allowing residents to freeze their credit reports. "We need to take serious, strategic action to make
sure state agencies are using the strongest encryption standards available in the case of data falling into the wrong hands."

Adam Behnen, an assistant inspector in charge for the U.S. Postal Inspection Service, said there's no sign the lost data was stolen. The lost checks haven't been cashed.

The tax office in Brainerd works on collecting tax debt from taxpayers statewide.

Kraatz said another regional office in Edina is testing technology to connect regional offices to St. Paul servers, eliminating the need to transfer backup server tapes by mail or courier. If the glitches are worked out, that technology could be in use by other regional offices in about six months, he said.

(© 2006 The Associated Press. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed.)