IMPD says sensitive information on some incident reports not redacted correctly
INDIANAPOLIS (WISH) — A standard police incident report is supposed to have names, addresses and social security numbers redacted, along with and all financial information.
But according to Indianapolis Metropolitan Police Department, some reports were released without those redactions, according to a statement the department sent to News 8.
IMPD is working with its technology services providers to assess how the disclosure happened.
IMPD isn’t saying how many reports with sensitive information were released. But they did say names, addresses, state identification numbers and financial information — including credit and debit card numbers — were released.
Scott J. Shackelford is an associate professor at Indiana University Kelley School of Business in Bloomington and serves as chair of the cybersecurity program. He says at least the city admitted the mistake.
“Even with that, we still have some provision here in state that could open the city to some liability” said Shackelford.
The reports are available via an online city of Indianapolis portal called payindy.gov, where you can pay parking and traffic tickets and other city fines. The site acts as the traffic cop for dozens of online financial transactions. The department claims the release of this sensitive information is not the result of a outside system breach.
“When we think about data breaches, the first thing that comes to mind is some third party, whether it is a criminal organization or even a nation-state trying to break into a system, you know, that is not necessarily how this always comes out. Insider threats are a real problem, either on purpose or in this case accidentally, releasing this information,” said Shackelford.
The department did say the sensitive information was released to a member of the public and they have contacted those affected.
“So as a result, this could put these people at an increased risk of identity theft for a long period of time,” said Shackelford.
The city and the department have shut down the incident report portal for the time being. If you need a report, you have to go to the City-County Building in person.