Metro to Settle Lawsuit After Exposing Employee Social Security Numbers

A little more than four years ago, Michael and Margaret Abbott were notified by the Internal Revenue Service that someone had attempted to file a fraudulent tax return in Michael's name. The former Metro employees were the victims of identity theft, and the explanation was pretty simple: Metro had put their personal information, including social security numbers, on the internet. In all, the social security numbers of 21 Metro employees were exposed after they were included in a Human Resources Department training manual that was on Metro's public website from 2012 to 2016. 

The Metro Council is set to approve a $22,000 payment tomorrow to settle the lawsuit that resulted. 

Metro Council attorney Mike Jameson's analysis of the council resolution explains what happened, including the fact that Margaret Abbott suffered a "stress related heart attack" one month after receiving the IRS notification about the theft. 

In June 2015, former Metro employees, Michael and Margaret Abbott, were informed by the Internal Revenue Service (IRS) that they were victims of identity theft and that someone attempted to file a fraudulent tax return in Michael Abbott’s name. In August 2016, the Abbotts learned that their names, addresses, and social security numbers were inadvertently exposed in an HR Department training manual that had been posted on Metro’s public website from 2012 to 2016. The Enterprise Business Solutions (EBS) manual was created by HR in 2005 for internal use by Human Resources coordinators from each department. The EBS manual contained actual employee data and a total of 21 social security numbers were exposed. The EBS manual was placed online in December 2012 for ease of access to HR coordinators, but was also publicly available to anyone.

On August 4, 2016, an HR coordinator from the Arts Commission reported a concern that the manual appeared to use actual employee data. The manual was removed from the website that same day, and the HR Department destroyed all paper copies of the training manuals and revised them to remove sensitive information. The EBS system had already been modified by the HR Department a few years earlier to mask sensitive employee data. All affected employees, including the Abbotts, were notified of this breach by certified letter on August 24, 2016 and offered two years of identity theft protection insurance.

The Abbotts were notified by the IRS of the attempted false tax return, but did not lose any potential tax refund they were owed. They were offered one year of free identity theft protection from Metro HR and have since purchased their own identity theft insurance, which they intend to maintain indefinitely at a current cost of approximately $160 per year. Ms. Abbott has a history of stress and anxiety related medical issues and suffered a stress related heart attack in July 2015, one month after the letters from the IRS concerning identity theft. The statutory claims asserted in their complaint include provisions for attorneys’ fees and costs. The Abbotts have agreed to accept a total of $22,000 in full settlement of this case.

While we're on the subject,

the case of a woman who was injured when an Metro Nashville Police Officer struck her vehicle while attempting to make a U-turn with his lights and siren on.