LEBANON, Ind. — Boone County officials are considering removing County Auditor Debbie Crum after an internal investigation found she emailed the personal information of all 290 county employees to the Indiana Department of Child Services. A public hearing on the matter will take place at 10 a.m . Oct. 6 in Lebanon. “Evidence in this matter will be presented at that time by County Attorney Beth Copeland,” said County Communications Director Brent Wheat. “By statute, no decision on the matter can be made at the hearing. After the applicable waiting period, the boards then may consider whether to petition the court for removal.” The county hired Taft Law Firm to provide legal advice on the case, with a budget not to exceed $25,000, Wheat said. Crum has not yet responded to requests for comment. The data leak happened on June 30. The internal investigation found that Crum emailed names and Social Security numbers to the state agency. Weeks later, a Department of Child Services (DCS) employee emailed that document to four Boone County employees and two county vendors for reasons that remain unknown, according to county officials. The investigation into the leak of sensitive information to unintended recipients followed this timeline: In May, DCS began its annual audit of the county’s financial records and contacted Crum. As part of the audit, DCS requested documents for specific employees involved in child support services. After Crum emailed an initial report that lacked the necessary information, a DCS employee sent a follow-up email identifying 12 specific employees whose records were required. In response, Crum asked the Boone County Human Resources Department for a report of all employees enrolled in the county’s long-term disability plan. She did not provide HR with the context or purpose of the request. HR generated the report and placed it on a secured network drive for the Auditor’s Office to retrieve. Crum retrieved the report on June 30 and emailed it to two DCS employees without opening or reading it first. The report contained information for all 290 employees in the disability plan, rather than just the 12 requested. Roughly three weeks later, a DCS employee forwarded the email to four county employees and two vendors. Boone County officials discovered the leak at that point. Indiana’s I-Team first reported the data disclosure. “Boone County recognizes the seriousness of any unauthorized disclosure involving employees’ personal information,” the county said in a statement to Indiana’s I-Team. “Protecting confidential information is a fundamental responsibility, and County officials regret that this incident occurred.” The county is implementing safeguards to strengthen how it handles and sends sensitive employee information. “The County is also taking measures to support those employees with resources to help protect their personal information, including credit monitoring and identity protection services,” the county statement said. Boone County Commission President Tim Beyer said employees have a right to expect their information will be handled with care and shared only when necessary. “Our investigation found that substantially more information than was requested was disclosed,” Beyer said. “We are committed to strengthening our procedures, supporting our employees, and taking appropriate action to ensure an incident like this does not happen again.” The county is encouraging employees to review their credit reports and financial accounts for suspicious activity. An email to employees also suggested they consider placing a fraud alert or security freeze on their credit files. “County employees deserve full confidence that their personal information is handled responsibly,” Boone County Council President Jennifer Hostetter said. “The Council is committed to supporting affected employees while carefully reviewing the findings of this investigation and considering any actions necessary to protect the integrity of county government.” Statements “The Indiana Department of Child Services (DCS) takes very seriously the protection of the information entrusted to us in providing services. “On July 21, 2026, DCS’ Child Support Bureau learned that data in its custody was inadvertently disclosed by email to both internal and external parties. While this information was originally provided to CSB by the Boone County Auditor for use in CSB’s ordinary course of business, it included additional data that the agency should not have received.  “DCS took immediate action to control the situation and is closely following state and federal protocols, including adhering to Indiana Code 24-4.9-3-1, commonly referred to as the “Indiana Security Breach Notification Statute.” Indiana Department of Child Services “I am truly sorry that the June 30 incident happened and that County employees were affected by it. I did not knowingly disclose anyone’s Social Security number, and I do not believe this single mistake is a lawful basis to remove me from office. I have continued to do the job the voters of Boone County elected me to do, and I look forward to the October 6 hearing so the full facts can be heard in public. I will not speculate about other allegations that have not been presented to me, but I am prepared to respond to any specific claims the County chooses to make.” Boone County, Indiana, Auditor Debbie Crum, a Republican ...read more read less