FEMA stated that they mistakenly exposed the personal information, including addresses and bank account information, of 2.3 million disaster victims.
The breach occurred because FEMA did not ensure a private contractor only received the information it required to perform its official duties.
The victims affected include survivors of Hurricanes Harvey, Irma, and Maria and the 2017 California wildfires.
The report found FEMA's failure to protect their data put them at risk of identity theft and fraud.
According to the report, some of the data collected, such as addresses and Social Security numbers, were necessary to give aid. but other information, like electronic bank account information, was not considered necessary.
"id": "FEM74612323",
"linkid": "fema",
"type": "Breach",
"date": "03/2019",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"