Offshore outsourcing cited in Florida data leak
State employees are being warned that their personal data may have been compromised
IDG News Service - Florida state employees are being warned that their personal information may have been compromised after work on the state's People First payroll and human resources system was improperly subcontracted to a company in India.
Employees who worked for the state during the 18-month period between Jan. 1, 2003, and June 30, 2004, may be affected, according to an e-mail message sent to all state employees on March 16. The state's Department of Management Services (DMS), which oversees the People First system, estimates that 108,000 current and former state employees may be affected by the data breach, although that estimate could change as the department's investigation into the matter continues.
The e-mail was sent after a subcontractor of outsourcing service provider Convergys Corp. improperly allowed subcontractors in India to index state personnel files, said DMS spokeswoman Tiffany Koenigkramer. The offshoring was done as part of Convergys's nine-year, $350 million contract to manage the state's personnel work.
Convergys had subcontracted the indexing work to GDXdata Inc., in Denver, which itself turned to a subcontractor in India, a violation of the GDXdata contract with Convergys, the DMS said. Convergys has since cancelled its contract with GDXdata, the agency said.
Convergys said the offshore work was done without its knowledge. "Convergys was misled by GDX, one of several subcontractors hired to perform work for the state of Florida," the company said in a statement.
The offshore work was made public in late December, when documents were unsealed in a "whistle-blower" lawsuit brought against GDXdata by two former employees.
The DMS is investigating the matter, but it has so far detected "no known cases of credit fraud or identity fraud that resulted from this work," Koenigkramer said.
"It is common today for businesses and even government to use offshore companies," the DMS March 16 e-mail states. "However, the use of offshore services in this case was inappropriate and unacceptable."
Convergys and the DMS expect to provide affected employees with a credit-protection plan this week, Koenigkramer said.
That is not enough for one of the state's public-employee unions, which is calling for an end to the Convergys deal and saying that the People First system has been mismanaged. "We want this thing killed," said Doug Martin, communications director at the American Federation of State, County and Municipal Employees, Council 79. "This is a joke, and the sad thing is, we're paying for it."
State Sen. Walter "Skip" Campbell, a Democrat who would also like to see the contract pulled, called the outsourcing a "critical security breach," in part because it inappropriately exposed sensitive information about the state's law enforcement agents. "We don't know how far the dissemination of this information has gone," he said.
Based in Cincinnati, Convergys is a provider of billing, customer service and human resources outsourcing services. It reported $2.5 billion in revenue last year, according to the company's Web site.
A spokeswoman for GDXdata declined to comment for this story.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts