Boone County explains how employee data disclosure happened
Aug 07, 2026
BOONE COUNTY, Ind. An internal investigation reveals the Boone County Auditor emailed personal information for all 290 Boone County employees to the Indiana Department of Child Services on June 30.Weeks later, a DCS employee em
ailed that document to four Boone County employees and two county vendors for reasons that remain unknown, according to Boone County.Boone County announced Friday it has completed its internal investigation into the disclosure of names and Social Security numbers to unintended recipients.Heres a breakdown of what Boone Countys investigation found: In May 2026, the Indiana Department of Child Services (DCS) initiated its annual audit of the County's financial records by contacting Boone County Auditor Debbie Crum. As part of the audit, DCS requested documentation related to certain employees whose work involves child support services, according to Boone County. After an initial report was emailed by Crum that did not contain the requested information, a DCS employee sent a follow-up email identifying to Crum the 12 specific employees whose records were needed for the audit. In response, Auditor Crum requested the Boone County Human Resources Department provide her a report of all employees enrolled in the County's long-term disability plan. The request did not include the context or purpose of the request, according to Boone County. HR generated the requested report and placed it on the County's secured network drive for retrieval by the Auditor's Office. On June 30, Auditor Crum retrieved the report and emailed it to two DCS employeeswithout opening or reading the report first, according to Boone County. Rather than containing information limited to the 12 employees identified by DCS, the report included personal information for all 290 employees enrolled in the County's long-term disability plan, including names and Social Security numbers. Approximately three weeks later, one of the DCS employees forwarded the email to four Boone County employees and two county vendors for reasons that remain unknown. Boone County officials discovered the disclosure at this point.Indianas I-Team broke the story last month about the employee data disclosure.We reached out to Crum for a response.Boone County recognizes the seriousness of any unauthorized disclosure involving employees' personal information, said Boone County in a statement to Indianas I-Team. Protecting confidential information is a fundamental responsibility, and County officials regret that this incident occurred.The County says it is implementing safeguards to strengthen internal procedures governing the handling and transmission of sensitive employee information.The County is also taking measures to support those employees with resources to help protect their personal information, including credit monitoring and identity protection services, said the county in a statement.County employees have every right to expect that their personal information will be handled with care, accuracy and accountability, and shared only when necessary," said Boone County Commission President Tim Beyer. "Our investigation found that substantially more information than was requested was disclosed. We are committed to strengthening our procedures, supporting our employees, and taking appropriate action to ensure an incident like this does not happen again."Boone County is encouraging employees to review their credit reports and financial accounts for suspicious activity.Employees should also consider placing a fraud alert or security freeze on their credit files, according to the email sent to Boone County employees.County employees deserve full confidence that their personal information is handled responsibly. The Council is committed to supporting affected employees while carefully reviewing the findings of this investigation and considering any actions necessary to protect the integrity of county government," said Boone County Council President Jennifer Hostetter.Indianas I-Team contacted Indiana DCS for comment and the agency provided the following statement:The Indiana Department of Child Services (DCS) takes very seriously the protection of the information entrusted to us in providing services.On July 21, 2026, DCS Child Support Bureau learned that data in its custody was inadvertently disclosed by email to both internal and external parties. While this information was originally provided to CSB by the Boone County Auditor for use in CSBs ordinary course of business, it included additional data that the agency should not have received. DCS took immediate action to control the situation and is closely following state and federal protocols, including adhering to Indiana Code 24-4.9-3-1, commonly referred to as the Indiana Security Breach Notification Statute.
...read more
read less