MONTPELIER — The state, in response to a data breach that led to personally identifying information including names, addresses and Social Security numbers being sent to the wrong addresses, will provide all 2020 unemployment insurance recipients with identity theft protection, Gov. Phil Scott said Tuesday.
In the meantime, Labor Commissioner Michael Harrington told the Senate Economic Development, Housing and General Affairs Committee that the department has stepped up quality assurance steps to make sure when 1099-G tax forms are resent later this month, there are no more mistakes.
The state is in process of recalling thousands of 1099-G forms sent to unemployment benefit claimants after it was discovered that names, addresses and Social Security numbers of claimants were sent to the wrong addresses. Scott has appointed one of his top advisors as deputy labor commissioner and assigned two teams from his administration to oversee the state response.
The identity theft prevention services will be retroactive to date of the breach, Scott said.
“The hope is this will provide some reassurance,” Scott said, “though I know it doesn’t come close to making up for the harm and worry.”
As for the cost, the state has purchased a cyberinsurance policy to protect Vermonters, Scott said. That means the cost to the state will be the $250,000 policy deductible instead of millions of dollars in fees for identity theft protection programs.
In the meantime, the “recapture mailings” seeking return of 1099-G forms went out Monday and Tuesday and should arrive by the end of this week or early next week, Harrington told the Senate committee. Information about identity theft protection will follow shortly.
Harrington said a preliminary schedule will be lined up over the next two days, at which point the state will share with Vermonters what they can expect.
Perhaps more importantly, Harrington said the department is working to restore trust after a breach that exposed Vermonters’ personal information, putting them at risk of identity theft.
“Obviously there’s a lot of lost trust given the situation and in the process,” Harrington said. “So we do think earning back that trust is making sure we cast a wide net for protection services.”
Harrington said if you filed in the standard unemployment program, “your 1099 is still downstairs in a locked room … your risk is low to zero. But even to some level we don’t want to overpromise and have someone misinterpret, or miss the fact they may have also received a supplemental benefit and didn’t realize it. So we’re trying to be inclusive in how we talk about it and the type of protection we offer ... to reassure and maybe allay some of the fears.”
“I do think we do have an obligation to help someone manage the fear,” he added. “When it comes to notifying, we’re trying to notify everybody.”
Committee members Sen. Michael Sirotkin, D-Chittenden, Sen. Kesha Ram, D/P-Chittenden, and Senate Majority Leader Alison Clarkson, D-Windsor, advocated for an online resource where unemployment recipients can plug in their information and find out if they were affected by the data breach. “I think that would allay some concerns,” Ram said. “People are less focused on which [benefit] program they were in,” Clarkson added.
Harrington said that there have been conversations with the third-party vendor about making that happen. At the very least, the department will communicate to claimants whether or not they’re in the high-risk groups, he said.
The state is recalling all 1099-Gs that went to unemployment claimants and reprinting and remailing the forms. Persons who received Form 1099s from the Department of Labor should set them aside for safe keeping, and then send them back to the state. (Self-addressed, stamped envelopes are being sent to facilitate the return.)
Harrington told the committee Tuesday that the department is having its work cross-checked and validated to be certain that names and correct Social Security numbers match. That includes correcting forms in which incorrect information was mistakenly provided by employers and employees.
The state Department of Labor had 180,000 1099-G forms to process and send out for the 2020 tax year, including “traditional” unemployment benefits and new state and federal unemployment programs in response to the COVID-19 pandemic. It’s hoped those forms will be headed out on or about Feb. 22, Harrington said.
It’s believed that human error occurred when data was being moved from the Department of Labor’s antiquated mainframe computer system to be processed for mailing. The breach appears to be limited to about 44,800 unemployment claimants who obtained benefits through the Lost Wages Assistance (LWA) program and the Vermont Short Term Supplemental benefit program.