CLIVE, IOWA – The Iowa Lottery inadvertently released the Social Security numbers of some of its prize winners from calendar year 2011.
“This release of sensitive data was unintentional,” Iowa Lottery CEO Terry Rich said. “On behalf of the entire lottery team, I apologize for this mistake. As we have said many times through the years, human involvement in any process means it will not be perfect. We are offering those impacted access to a credit-monitoring service and reviewing our procedures to identify improvements that can be made as we move ahead.”
The release occurred as the lottery was responding to a journalist’s open-records request for a list of all Iowa Lottery winners of $600 or more since the Iowa Lottery’s start in 1985. Lottery winner lists are open records under Iowa law. The lottery responded to the journalist’s request on April 12 and the data provided was published in mid-September on a website. The data was on that website for about 10 days until Sunday afternoon, when it was removed at the lottery’s request.
In working to comply with the open records request for more than 30 years’ worth of data related to prize winners, the lottery needed to access information in multiple databases on multiple platforms, then compile the applicable details into one spreadsheet. In the process of doing that work, additional information was inadvertently left in the resulting spreadsheet only for those winners from calendar year 2011. That information included 2,967 unique Social Security numbers for the winners of Iowa Lottery prizes of $600 or more in calendar year 2011.
It was not immediately clear that Social Security numbers for some Iowa Lottery winners had been released, as the details did not appear in the main text of the spreadsheet involved. Further, in the tabs where the information did appear, the data was in unrecognizable abbreviations that required further steps by the user to view the details involved.
A member of the public noticed the Social Security numbers on the website and notified the lottery about the situation Friday night. Lottery personnel then worked to identify the source of the information and pinpointed those details Saturday morning. The lottery then reached out to the journalists who had requested the information and asked them to remove it from the website, which they did on Sunday. On Monday, the lottery provided the journalists with another copy of the data they had requested that did not include sensitive information relating to its winners.
“As soon as the lottery realized that some of its winners’ Social Security numbers had been released, we began work to address the issue,” Rich said. “This incident reminds us that we must continue to be vigilant in our efforts to protect sensitive information. It is imperative that we continue to monitor and check any information we provide in our daily work as Iowa Lottery employees.”
