APD: Personal information was exposed through unredacted collision reports that were available online

ANCHORAGE, Alaska (KTUU) - Unredacted reports containing the personal information of thousands of people involved in car crashes were released in error for nearly two years, according to the Anchorage Police Department.

APD Captain Sean Case said an investigation revealed 11,402 people were impacted by unredacted traffic collision reports that were uploaded to a third-party vendor, LexisNexis, and released.

The investigation, conducted by a third-party firm, revealed that unredacted versions of APD’s traffic collision reports had been uploaded to LexisNexis from April 2019 through Feb. 15 of this year.

The two pieces of information APD said should have been redacted, but were not, are people’s dates of birth and driver’s license numbers.

According to Case, APD uses LexisNexis to make the reports available for download.

“Collision reports are the only reports that we have that get auto-redacted and then uploaded into LexisNexis because of the volume of the requests,” Case explained. “If you can imagine, you get a traffic collision report and your insurance company wants a report or wants a copy of that report.”

Case said the issue was discovered in February when a woman called APD wondering how someone had obtained her information.

“We had someone call in that was a witness to a traffic collision and someone who’s involved in the traffic collision called her, and she asked, ‘How did you get my information?’ and he said, ‘I got a copy of the police report,’” Case said. “She then called us and told us that story.”

He said the information the individual likely used, such as the woman’s name, was not information that needs to be redacted, but an APD clerk followed up and realized other information — the woman’s date of birth and driver’s license number — should have been.

“The clerk that got the information, did her due diligence and looked back just to verify what this person actually got and found out that that traffic collision report was not redacted,” Case said. “And that started the process of, has this happened before, how many? And so we started tracking it back.”

“It’s pretty much a toggle, if you will, a checkbox that said, ‘redact the public traffic collision reports’ that was unchecked or not switched,” Case continued.

He said the investigation did not determine whether the setting was changed by accident or intentionally, or who was responsible, but that new procedures are in place now to make sure the settings are checked often and that the records are being automatically redacted.

“APD has no evidence of any actual or attempted misuse of the personal information,” the department wrote in a public notice to the community on Wednesday. “Only traffic collision reports were involved in this incident; social security numbers are not listed on traffic collision reports.”

The alert said everyone impacted by the incident will receive a letter outlining the issue and steps they can take to protect themselves. They’ll also be offered one year of credit monitoring.

Anyone who believes they should have received a letter and have not by June 30 can call the records department at 907-786-8900.

According to Case, APD did not find any evidence the unredacted information had been used maliciously or used at all.

An APD spokesperson said the combined cost of the third-party firm to investigate the issue and the credit monitoring service amounts to $18,423.