Mayor alleges data breach
Spa City investigating if ex-mayor was sent residents’ information
City officials are investigating if former Mayor Meg Kelly and other past elected officials accessed residents’ contact information in 2020.
Mayor Ron Kim said on Monday that an email list from the Department of Recreation, which falls under the mayor’s office, was shared with Kelly. He said that the list included the information of several thousand residents who participated in the city’s recreational activities.
The list was sent to several employees outside of the recreation department who would normally not have access to that information on Oct. 21, 2020, according to an initial investigation by the city’s IT department. Kim said that Kelly received the list, which was sent to her personal Gmail account.
“It may also have been released by other elected officials, and we are continuing to investigate that possibility,” he said, calling the release a serious breach of protocol and trust.
Kelly had not returned a call for comment by Tuesday afternoon.
Kim alleges that in the fall of 2020, when the recreation department was facing cuts, Kelly demanded the list. Kim said the recreation employees were reluctant to give it to her, but complied. Since then, Kim said City Hall has been contacted by people who received unsolicited emails that look like they were pulled off the recreation department list. One person said a campaign email arrived in her recreation business-only email.
“We don’t want to expose people’s email addresses and private information,” Kim said. “But we had people who came to us and said the email must have come out off your recreation list.”
Kim said the city is now investigating if any laws were violated and, if so, who would investigate the violation.
“As soon as we confirmed that there was a release that was not authorized we wanted people to know,” Kim said. “That’s a standard practice.”
Kim added the city is taking steps to prevent something like this from happening again.
“While no information other than the email addresses and names of residents appears to have been shared, we did want to make everyone aware of this past breach as soon as we knew it had occurred and we assure you that we will not tolerate this activity from any city employee — elected or appointed — in the future,” he said.
At the end of her second two-year term in 2021, Kelly was the subject a city ethics committee investigation to determine if she used the power of her office to win a $200,000 grant for a private school where she worked. She was also accused of providing its students access to her office through exclusive internships. The Board of Ethics concluded “there is no reasonable cause for believing (Kelly) violated the City’s Ethics code.”