FOLLOW US

The Federal Emergency Management Agency (FEMA) failed to safeguard the sensitive personal identifiable information (SPII) of 2.3 million survivors of hurricanes Harvey, Irma, Maria and the California wildfires in 2017.

The disaster survivors affected by the privacy incident or breach are at risk of becoming victims of identity theft and fraud.

The Inspector General’s Office of the Department of Homeland Security (DHS) discovered the privacy incident during an ongoing audit of FEMA’s Transitional Sheltering Assistance (TSA) program.

FEMA provides transitional sheltering in hotels to people displaced by emergencies or major disasters through the TSA program.

According DHS Acting Inspector General John V. Kelly, FEMA improperly released disaster survivors’ SPII to its contractor. Some of the sensitive information exposed includes personal addresses and banking information such as electronic funds transfer number and bank transit number.

Kelly said that the unnecessary transfer of disaster survivors’ SPPI to the contractor is a violation of the Privacy Act of 1974 and DHS policy. He recommended corrective actions to FEMA to prevent any privacy incident in the future.

FEMA implemented measures to mitigate the breach

FEMA accepted his recommendations and started implementing measures to assess and mitigate the breach. The agency deployed a Joint Assessment Team of cybersecurity personnel to its contractor’s facilities. The team documented and removed the improperly shared sensitive personal information to its contractor’s systems.

Based on the team’s assessment, there is “no indication of intrusion” on its contractor's systems within the last 30 days.” However, the team found that the contractor did not maintain logs after 30 days.

In a statement on Friday, the agency's Press Secretary Lizzie Litzow, said, “Since discovery of this issue, FEMA has taken aggressive measures to correct this error.”

Additionally, she said the agency is “no longer sharing unnecessary data with the contractor and has conducted a detailed review of the contractor’s information system.”