US disaster agency exposed private data of 2.3m hurricane and wildfire survivors

The US disaster relief agency unnecessarily released sensitive identifiable data, including banking information, of 2.3m disaster survivors to an outside contractor, according to a report by theOffice of Inspector General.

The survivors, who were affected by hurricanes Harvey, Irma, and Maria, as well as the 2017 wildfires in California , had provided their information to the Federal Emergency Management Agency (Fema) while applying for transitional sheltering in hotels.

“Since discovery of this issue, Fema has taken aggressive measures to correct this error,” Fema press secretary Lizzie Litzow said in a statement. “Fema is no longer sharing unnecessary data with the contractor and has conducted a detailed review of the contractor’s information system,” she added.

Related: ‘Unprecedented’ US flood season will imperil 200m people, experts warn

Fema must send some identifying information of survivors to contractors in order to verify disaster survivor eligibility, but in this situation, Fema officials also provided details such as the survivor’s bank, the survivor’s “electronic funds transfer number”, and the “bank transit number”.

Femaviolated federal requirements in releasing this information, the report found. The report does not name the contractor, but noted that the release of the information occurred because Fema “did not ensure it shared with the contractor only the data elements the contractor requires to perform its official duties”, according to the report. Instead, the agency released more, including the survivors’ home addresses, cities of residence, and zip codes.

Fema says it has found no indication the survivor data was compromised, and the organization says it has worked with the contractor to remove the unnecessary data from the system.

Flooded homes in Florida, six days after Hurricane Irma.Photograph: Nicole Raucheisen/AP

Because none of the data had been compromised, Fema did not reach out out to the disaster survivors to let them know that their information had been released unnecessarily.

Hurricane Harvey struck southeast Texas in August 2017, causing $125bn in damages and killing 68. Later that month, Hurricane Irma touched down, claiming 97 lives and inflicting $51bn in clean-up costs as it walloped through the Florida Keys and the Caribbean. In September 2017, Hurricane Maria devastated Puerto Rico, killing more than 3,000 and leaving thousands without electricity for months.

This same year was one of the worst years for wildfires in California history, with more than 9,000 blazes tearing through the state, including through Northern California’s wine country and parts of southern California. Five of the fires rank in the state’s top 20 most destructive wildfires.