VA investigates, changes policy after local data breach

WASHINGTON, D.C. (WAVY) – The Department of Veterans Affairs says it will conduct an internal investigation and make changes to the way it handles veterans’ personal information after a veteran in Williamsburg was mistakenly sent private information for 12 other veterans.

10 On Your Side first published the story Friday of James Graves, a day after the Army veteran received documents intended for other veterans from Virginia.

Instead of his own medical records he had requested from the VA several weeks earlier, he received information about VA financial payments based on his dependents. Not just for him, but for 12 additional veterans from Virginia.

“This should infuriate anybody,” Graves said.

That’s exactly how one of the victims reacted when we told her that her information was compromised.

“I was furious. I was absolutely furious,”  Navy veteran Shauncey Maver said. “Under the requirements by law, it’s privacy protected.”

The documents had social security numbers, home addresses, financial information and even names of children.

“This is our children and we do everything in our world to protect them,” Maver said.

The letters look like originals because they have two binder holes punched in the top of each page. Since WAVY’s story on Friday, the VA sent Graves a self-addressed envelope to return the documents. But Graves wants the affected veterans to have evidence of what happened, so in addition to returning the originals to the VA, he’s sending copies to each of them by certified mail.

Here’s what the VA is doing about it: An agency spokesman sent WAVY-TV a statement that reads in part, “We are conducting an internal investigation to determine if the situation warrants accountability actions. If that’s what the investigation finds, we will take appropriate actions, while respecting due process.”

The VA is also giving the 12 victims free credit monitoring. In addition, its changing the way it handles and mails this type of sensitive information, installing a new system which it says will  “dramatically reduce these types of errors in the future.”

“I’m glad you called me. I wouldn’t have ever known,” Maver told WAVY’s Chris Horne. “If [Graves] hadn’t have been honest and contacted you, I would have never known.”

The following is the full statement from the Department of Veterans Affairs:

We are conducting an internal investigation to determine if the situation warrants accountability actions.   If that’s what the investigation finds, we will take appropriate actions, while respecting due process.

In the meantime, we will offer credit monitoring to the Veterans whose personal information was disclosed.  Also, to dramatically reduce these types of errors in the future, VA is initiating a program called the Centralized Benefits Correspondence Management Program (CBCM), to be in place next year, that centrally prints and mails outbound correspondence to Veterans.”