Florida state employees are being warned that their personal information may have been compromised after work on the state’s People First payroll and human resources system was improperly subcontracted to a company in India.

Employees who worked for the state during an 18 month period between Jan. 1, 2003 and June 30, 2004 may be affected, according to an e-mail message sent to all state employees on March 16. The state’s Department of Management Services (DMS), which oversees the People First system, estimates that 108,000 current and former state employees may be affected by the data breach, although that estimate could change as the department’s investigation into the matter continues.

The e-mail was sent after a subcontractor of outsourcing service provider Convergys improperly allowed subcontractors in India to index state personnel files, said DMS spokeswoman Tiffany Koenigkramer. Transferring information offshore is in violation of Convergys’s nine-year, $350 million contract to manage the state’s personnel work.

Convergys had subcontracted the indexing work to GDXdata in Denver, which itself turned to a subcontractor in India, the DMS said. Convergys has since cancelled its contract with GDXdata, the agency said.

Convergys says that this offshore work was done without its knowledge. “Convergys was misled by GDX, one of several subcontractors hired to perform work for the State of Florida,” the company said in a statement.

The offshore work was made public in late December when documents were unsealed in a “whistle-blower” lawsuit brought against GDXdata by two former employees.

The DMS is investigating the matter, but it has so far detected “no known cases of credit fraud or identity fraud that resulted from this work,” Koenigkramer said.

“It is common today for businesses and even government to use offshore companies,” the DMS March 16 e-mail states. “However, the use of offshore services in this case was inappropriate and unacceptable.”

http://www.networkworld.com/news/2006/032406-offshore-outsourcing-florida-data-leak.html