Blumenthal filed the action on behalf of state Comptroller Nancy Wyman, whose office contracted with Accenture. The lawsuit alleges that Accenture converted state property to its own use without state permission, acted negligently and violated its state contract by allowing the highly sensitive data to be placed on a state of Ohio back up computer tape that was later stolen. The theft occurred in June, but Wyman's office was not notified until September 4.
The lawsuit seeks damages and reimbursement for state resources expended to protect and secure the information, as well as an order returning some money already paid the company.
"Accenture deserves censure -- to be held accountable for allowing valuable secret data to be stolen and putting at risk state taxpayers, bank accounts and purchasing cards," Blumenthal said. "Accenture acted unconscionably and illegally. It breached its commitment to keep confidential this highly sensitive financial information. The company broke its contractual promises and duty of care to safeguard the secrecy of sensitive data. It misappropriated state property -- taking significant valuable data for its own use without permission or authority.
"Transferring this data to Ohio is inexplicable and inexcusable. Confidential information can have the value of cash -- especially in the wrong hands -- but Accenture treated it like scrap paper. Its breach of contract and negligence exposed state taxpayers to identity theft and other harm," continued Blumenthal.
"The documents provided to me show that the comptroller responded conscientiously, forcefully and promptly to the threat of harm raised by Accenture's misconduct. I appreciate her responsible actions and her partnership in this next chapter of our aggressive, legal fight to vindicate the state's rights," Blumenthal said.
The comptroller said she was able to analyze the tape and secure the data within a period of days by working with several state agencies in Connecticut and Ohio, banks and credit-protection services.
"My first priority in this incident was to take whatever steps were needed to secure the data and protect the state and its taxpayers from any potential harm," Wyman said. "I am pleased to say that there is no indication that any of this data has been compromised in any fashion."
Wyman said Accenture must be held responsible for putting confidential information at risk in direct violation of its contract. The company has already agreed to pay for all costs of providing credit-protection to the affected individuals.
"I told Accenture early on that I expected them to make our taxpayers whole," Wyman said. "Accenture is fully responsible for this situation, and with this action today they will be held fully accountable."
Blumenthal added, "We seek recovery of some of the money already paid, as well as all costs or damages present or future, and sanctions that send a message: We will not tolerate reckless failure to safeguard sensitive financial data. We paid Accenture to follow the rules. Its failure should have consequences."
The tape included information on several hundred state agency bank accounts and 754 agency purchasing cards -- only 298 of which were active. Data on the tape is difficult to access, making it unlikely the thief will be able to view the information. There is no indication that any money was improperly withdrawn or of improper charges on the purchasing cards.
Accenture Responds
In its own release, Accenture said it is conducting a review of the Connecticut data security matter and says it believes its policies were inadvertently not followed. "We intend to take appropriate actions with any
individuals involved and to reinforce with all of our employees, as we do on a regular basis, the importance of following our privacy and data protection policies," said the release.
"We will provide credit monitoring services to the approximately 60 affected individuals in this case. We will also work with the state to safeguard any other data contained on the tape stolen in Ohio.
"Fortunately," continued the release, "there is no evidence that the state of Connecticut data has been accessed or misused by an unauthorized third party. As the Ohio Inspector General determined, the technical complexity of retrieving the data from the back-up tape storage device makes the possibility that it will be used for improper purposes remote."
Accenture went on to say that it will continue to cooperate with the state of Connecticut as it reviews the current situation, that it regrets the unfortunate incident "which was clearly caused by human error," and that it is committed to working with its client in the matter.
