WINTON – The Hertford County Tax Collector has been suspended without pay for 30 days due to the inadvertent release of taxpayer Social Security number information online.

Meanwhile, local officials are working closely with the county’s insurance carrier to judge the severity of the breach of confidential information.

Hertford County Manager Loria Williams said the suspension of Gay Sumner went into effect immediately, upon the Board of Commissioners voting unanimously to levy the disciplinary action during an emergency meeting held late Tuesday afternoon in Winton.

The meeting was called a little more than 24 hours after county officials learned the Social Security numbers of approximately 1,000 taxpayers were included on a spreadsheet that was part of the Tax Collector’s page on the Hertford County local government website. Those impacted by the breach were on a delinquent tax lien list for tax years 2005-2013. Typically, that type of information only includes the name, PIN (Parcel Identification Number) and amount owed per tax year by a delinquent taxpayer.

Following a 91-minute closed session, Commission Vice Chairman Ronald Gatling read the following statement, which was approved for advertisement by the board:

“The posting of a list of delinquent tax liens for tax years 2005 thru 2013 on the Hertford County website has resulted in a breach of confidential information, i.e. Social Security numbers for a number of taxpayers. The county has reported this event to our insurance carrier, NCACC (North Carolina Association of County Commissioners) Risk Management Pool of which cyber coverage is designed for instances such as this. It is an ongoing investigation that was initiated on Sept. 22, therefore at this point little is known as an absolute certainty of fact. The Risk Management Pool has the appropriate people ready to do what is necessary by law and they are in the process of being engaged. Hertford County has every intention of following the requirements set out in the law.”

Gatling, filling in Board Chairman Bill Mitchell who was not present at the meeting, added, “More information will be provided as we receive recommendations from the experts of the Risk Management Pool.”

After the meeting was adjourned, Williams confirmed to the Roanoke-Chowan News-Herald that the county is covered, from a liability standpoint, in cases such as this. However, this early into the discovery of the breach of information, Williams said she is unsure as to what extent the liability issue will come into play.

The posting of the delinquent tax lien list to the county’s website took place Aug. 14.  It wasn’t until Monday (Sept. 22) that county officials were made aware that the online listing contained confidential information. Williams said the discovery was made by an individual visiting the county’s website who in turn contacted local officials to make them aware of what was posted online.

“We immediately pulled the information off our website once we were made aware it was there,” Williams stated.

Upon being asked by this newspaper, Williams said it cannot be currently ascertained the number of times this particular information was viewed before being taken off the website.

Williams said the online posting of the delinquent tax liens was done in the form of an Excel document, meaning those 1,000-or-so listings were together on a single spreadsheet.

As to how to prevent a reoccurrence of posting sensitive material online, Williams said all new information that is destined to be posted on the county’s website will come first before her eyes.

“It will be monitored and screened by me before being added to our website,” she said. “That’s a short term plan; we will certainly develop a policy as to what types of information requires a review.”

“We also anticipate the Risk Management Pool’s cyber team experts to make some recommendations as to how to prevent something such as this from happening again,” added Murfreesboro attorney Chuck Revelle who serves as legal counsel to Hertford County local government.

Williams said for the present, the Risk Management Pool is continuing to probe the severity of the breach.

“We will forward to them any correspondence we receive, to include complaints, in the wake of this situation for their immediate review,” Williams said.