The city of Houston is admitting it made a mistake after the personal information of more than 800 current and former city employees was sold by the city at auction earlier this year.

Nine zip drives containing names, social security numbers and other financial information were locked inside a filing cabinet sold in February to Tom Norris, who contacted a local CBS News affiliate to examine the disks after he said he was repeatedly ignored by the city.

“It was a big surprise,” Mr. Norris told the affiliate. “I just couldn’t believe they let that kind of information flow.”

He said he could tell that the filing cabinet wasn’t empty when he picked it up at the city’s warehouse, but workers told him the cabinet and its contents belonged to him now.

“I was appalled,” Mr. Norris said. “They’re handing out information. I don’t know what’s on there, but I imagine it could be pretty damaging.”

Gary Huestis, an expert in digital forensics for e-Investigations, examined the disks, some labeled “accounting,” and found 829 names with Social Security numbers and payroll details, CBS reported. Mr. Huestis said the files were neither password protected nor encrypted.

“Zip drive and Microsoft Excel and you can see what’s on here,” he told the station.

The files, some dating back to the early 2000s, appeared to come from the city’s municipal courts division, the CBS affiliate reported.

“Somebody’s head should roll for this,” Mr. Norris said. “Anybody could have signed up and wound up with these disks.”

The city reportedly ignored six requests for an interview with the affiliate, KHOU 11, to explain what happened. Instead, a spokesperson for Mayor Sylvester Turner issued a statement:

“It was a mistake that should not have happened. The City is notifying the affected individuals. The City is aware of how important personal information is and we take employee privacy very seriously. Our goal is to prevent breaches of sensitive data, and we are implementing new standard operating procedures to ensure this does not happen again.”

Mr. Norris said he returned the disks to the city Monday afternoon after he was assured the city would take the issue seriously.

“I was finally able to get some assurances in writing from the city that they were going to actually follow through with an investigation and notify all the people that their information had been compromised,” he told KHOU.

Sign up for Daily Newsletters Manage Newsletters

Copyright © 2020 The Washington Times, LLC. Click here for reprint permission.