Investigation: Scope of Cameron Co. Personal Information Breach Unknown
BROWNSVILLE – The Texas Attorney General's Office is investigating how a Cameron County computer server with the personal information of tens of thousands of residents ended up at a flea market.
In May, CHANNEL 5 NEWS reported an analysis of a server purchased at the 77 Flea Market in Brownsville. The server, identified with Cameron County inventory stickers as Server 004449, contained county information.
Inside server 004449's hard drives were law enforcement databases and voter registration lists. CHANNEL 5 NEWS accessed the unencrypted data using simple data recovery methods.
The largest voter registration list contained names addresses and Social Security numbers of Cameron County residents. We estimated the file, of more than 900 pages, contained about 30,000 identities.
The voter registration list was small enough to send in an email.
Three days after our investigation aired, Cameron County Judge Eddie Trevino issued a statement promising a "full investigation."
"The county administrator has been working with all departments involved in the disposition of county equipment to determine if the issue has been contained."
The Cameron County commissioner's court also met several times behind closed doors to discuss "legal issues regarding the computer center." But the discovery was not discussed in a public session.
Two months later, CHANNEL 5 NEWS followed up on the status of the investigation, and efforts to contain any further data loss. Trevino told us the investigation could not be concluded until the county formally verified the contents of the server.
"We can’t complete it until we have access to all that you keep alluding to, but you won't allow us to look at," he said.
CHANNEL 5 NEWS handed over Server 004449 to the Texas Attorney General's Office in May. During a recent visit to the Rio Grande Valley, Attorney General Ken Paxton said they’re investigating the incident.
"It's an ongoing investigation so I couldn't comment on any details. Just to say that we are involved with that issue,” he said.
Through Cameron County records, CHANNEL 5 NEWS discovered an IT specialist signed off on an auction verification form that included Server 004449. Those items were slated for a December 2016 auction.
The auction verification affirmed, by signature, that equipment was "properly cleared of any data," and "no confidential information can be viewed or accessed."
We found that affirmation to be untrue.
The "equipment for auction verification" didn't just include Server 004449. It included 19 computers, a laptop and five more servers.
CHANNEL 5 NEWS attempted to track down those additional items sold at the December 2016 auction. We purchased additional Cameron County computer equipment from the flea market vendor who purchased Server 004449 at the December 2016 auction.
We compared the computer equipment from the 77 Flea Market vendor to the December 2016 auction list. We discovered no positive matches.
This means the computer equipment sold at the December 2016 auction is still out there somewhere. The data they contain and the damage it could do is still unknown.