The personal information of disaster loan applicants that was exposed last month by an unsecure federal government website is more extensive than previously disclosed, documents show.
The 100 applicants seeking Economic Injury Disaster Loans from the U.S. Small Business Administration had their financial and insurance information, citizenship, household size and marital state potentially revealed to other applicants using SBA’s online application portal.
The portal was disabled after the problem was discovered on March 25. At the time, SBA confirmed that loan applicants’ names, addresses, birth dates and Social Security numbers had been exposed.
“To date, there is no evidence to suggest that there has been any attempt to misuse any of the information,” SBA said in a letter to the affected loan applicants. The agency directed them to apply for one-year of free credit monitoring by ID Experts of Portland, Oregon.
The letter, which a loan applicant sent to Newsday, is dated April 13 — nearly three weeks after SBA found out its application portal wasn’t secure.
The agency “discovered on March 25, 2020, SBA’s disaster loan application website may have led to the inadvertent disclosure of personally identifiable information,” the letter states.
Asked about the time lapse between discovery of the faulty web portal and notification of the affected loan applicants via snail mail, SBA spokeswoman Jennifer F. Kelly said this week the agency “followed its security and privacy incident response procedures and federal requirements.”
SBA told Newsday on March 27 that it was “in the process of notifying impacted applicants.”
The agency hasn’t yet provided geographic information for the business owners who had their personal information disclosed. It has said it saw “a surge of applications from Long Island” between March 19, when state residents could begin submitting forms, and March 27.
SBA rolled out a new “streamlined” application process, and on April 1 told business owners to reapply for an EIDL. The program exhausted its congressional allocation of $17 billion last week.
The deadline for the affected applicants to apply for free credit monitoring from ID Experts is Sept. 13, the letter states. An ID Experts executive did not respond to a request from comment this week.
A note to our community:
As a public service, this article is available for all. Newsday readers support our strong local journalism by subscribing. Please show you value this important work by becoming a subscriber now.SUBSCRIBE