Online info leak vexes MLL players
Brighton-based Major League Lacrosse informed players on Monday of a data leak that exposed personal information, including Social Security numbers, via a public link on its website.
The MLL player pool, which includes active, inactive and tryout members, received an email from Colin Keane, the league’s operations manager, regarding the breach.
“On Thursday, August 24, 2017, we became aware that a link on our player pool registration inadvertently linked to an Excel spreadsheet which contained your full name, address, telephone number, email address, Social Security number, citizenship, date of birth, height, weight, position, college, graduation year, team, and non-MLL occupation,” read the email, which was obtained by the Herald. “Upon discovery, we immediately disabled this link and began an investigation into the matter.”
According to the email, the data was available online beginning last Wednesday, and the league was not aware of the spreadsheet’s public availability until Thursday. Several players dispute that timeline.
“I actually found out last Wednesday,” Florida Launch midfielder Tim Barber said. “I know multiple people had contacted the league about the spreadsheet’s availability on Wednesday.”
The league did not inform affected players until Monday at 5:30 p.m.
“The individuals that were aware of the information breach went home for the weekend without making the players aware that their personal information was shared publicly,” New York Lizards player and MLL players’ council representative Ryan Flanagan said in a statement to the Herald.
The spreadsheet was not password protected or encrypted, giving anyone with the link access to the personal information. In the email, the league advised players to establish fraud alerts on their credit reports and to place a credit freeze on any accounts.
Flanagan and the players’ council say this was not the first-time players’ personal information might have been shared without proper permission or security.
“The spreadsheet that was shared publicly with player information has been shared privately on more than one occasion,” Flanagan said. “Players have previously requested that the file not be shared with anyone, and that any files with player information be encrypted and password protected. This request was clearly ignored.”
MLL had yet to release a public statement or reply to Herald inquiries as of last night.
“Most guys are confused,” Cannons midfielder Josh “Hank” Hawkins said. “Most teams have a group chat, and in our group chat, guys are asking if they should take the suggestions (the league) gave.”
Said Barber, who just finished his second year in the league: “Everyone’s on edge. Anyone could have downloaded it to their computer. Whomever accessed it might have that information for good.”
Players have attempted to unionize in the past but failed. Instead, they created the players’ council, led by Flanagan, but it has little input into league operations.
The timing of the spreadsheet’s availability seems to be connected to the league’s player movement period, which began Monday. Player movement is a year-old league policy in which players with an expiring contract and five or more seasons under their belt may seek out new contracts. If the player signs with a new team, his old team is eligible for compensation.
Many MLL players are not full-time professionals, making current address and “non-MLL occupation” information important to league general managers. They might use this information to gauge a player’s ability to fit practices and games into their existing schedule, influencing whether they will make a player an offer.
“Our starting goalie works on Wall Street and works 12 hours a day,” Hawkins said. “And then he comes and makes saves for us on the weekends.”
The data leak comes as the MLL is in the midst of upheaval. David Gross, the only commissioner the league has ever had, recently stepped down after 13 years at the helm. No replacement has been named. However, the league continues to make strides with television coverage — with games on CBS Sports Network and live-streamed on Twitter — and has an expansion plan in place.
Hawkins, a five-year veteran of the league and Lax Sports Network commentator, says after a season in which disorganization in the league’s front office was apparent, Monday’s news might have pushed some players to the edge.
“I think some are asking, ‘Is this the last straw with this league?’” Hawkins said. “We are at our wits’ end about the disorganization. We feel disrespected.”