Backup tapes containing the personal information of nearly five million current and former US soldiers have gone missing.
Data on the backup tapes belonged to Tricare, a health benefits provider for military personnel, retirees and their dependents, but the information had been entrusted to defence contractor Science Applications International Corporation (SAIC), which reported the breach.
The compromised data regarded 4.9 million people who sought care at military treatment facilities in the San Antonio, Texas area between 1992 and 7 September this year. The data included social security numbers, addresses and phone numbers, as well as information such as clinical notes, lab-test reports and prescription information.
A statement from Tricare said a data breach was reported on 14 September. It confirmed that there was no financial data involved and the risk of harm to patients is judged to be low as "retrieving the data on the tapes would require knowledge of, and access to, specific hardware and software, as well as knowledge of the system and data structure".
The statement also said the data was not encrypted because the government facility at which the backup was performed was not capable of doing so to federal standards.
“The exact circumstance surrounding this data loss remains the subject of an ongoing investigation,” the statement said. “We did not want to raise undue alarm in our beneficiaries and so wanted to determine the degree of risk this data loss represented before making notifications.”
Tricare confirmed that it and SAIC were reviewing data protection security policies and procedures to prevent similar breaches in the future.