Active-duty troop information part of stolen VA data

The names, Social Security numbers and dates of birth of some 50,000 active-duty military personnel were included in the data on 26.5 million U.S. veterans stolen from the residence of a Department of Veterans Affairs (VA) employee, exposing them to possible identity theft, the department announced Saturday.

Several veterans' groups announced Tuesday that they have filed a lawsuit against the VA for failing to protect their personal information.

In its efforts to better learn just what information was contained in a duplicate database stolen from the VA employee last month, the VA said it had hired its own independent forensic experts to analyze the original data, Secretary of Veterans Affairs R. James Nicholson said in the statement.

The VA said it has not received any reports that the stolen data has been used for fraudulent purposes.

As for the active-duty personnel whose personal information may have been breached, the VA said that group includes up to 20,000 National Guard and Reserve personnel who were on at least their second federalized active duty call-up as well as 30,000 U.S. Navy personnel. That group could include members of the U.S. Navy who remain on active duty and completed their first enlistment term prior to 1991, the VA said.

"This happened because these individuals were issued a "DD-214" – or a separation from active service notification – by the Department of Defense (DOD) upon completion of their first enlistments," according to the statement. "This triggered an automatic notification to VA that these individuals were no longer on active duty. Subsequent to VA receiving the initial DD-214, these individuals re-enlisted for another term of active duty, meaning their information could still be in VA's data files."

The VA said it is working with the DOD to match data and verify those potentially affected. The VA is sending letters to those whose personal information may have been stolen, and said it has no evidence that other full-time, active duty personnel from the other military branches are affected.

In the wake of the data theft, the Vietnam Veterans of America (VVA) has joined four other national organizations and several individual veterans in a class-action lawsuit seeking judicial oversight and protection of the VA computer files.

"It is appalling to all veterans that their personal information -- information that is supposed to be held in confidence -- is potentially in the hands of individuals who can wreak identity-theft havoc," John Rowan, national president of VVA and a plaintiff in the lawsuit, said in the statement. "VA Secretary Nicholson has said he is ‘mad as hell' over this incident and the breakdown in command and control of his department, and we believe him.

"However, he has yet to answer some critical questions: What was an employee of the VA doing with the names, Social Security numbers and dates of birth of all these veterans, the vast majority of whom have never availed themselves of VA services? Why is the VA collecting this information in the first place?"

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.