Insider Error Exposes County Data, Taxpayers Face $25,000 Tab

1,300 county employees and their family members had sensitive personal data exposed after a routine public-records response went wrong, and Citrus County taxpayers may now be on the hook for roughly $25,000.

Mike Bridges and the attachment error

The exposure began when County Records Manager Mike Bridges responded to a public-records request tied to a personnel matter involving Growth Management Director Joanna Coutu. Bridges mistakenly attached a 74-page spreadsheet that listed employees and family members enrolled in the county’s health insurance plan and included individuals’ Social Security numbers.

Bridges admitted in a memo that he failed to adequately review the email attachments before sending them. After the mistake came to light, he lost his position at the county.

The exposed data: 74 pages, Social Security numbers, 1,300 people

The spreadsheet contained personally identifiable information for about 1,300 county employees and their family members. The attachment included Social Security numbers, making the incident an identity-exposure event rather than a routine disclosure of non-sensitive records.

The initial recipient forwarded the attachment to two additional people. The county was notified of the error after those forwards, and the additional recipients were contacted by the Sheriff’s Office to confirm that the information had been deleted.

Cyber insurance, legal services, identity protection — and a deductible

After discovering the exposure, Citrus County contacted its cyber liability insurance carrier. According to the county’s disclosures, the policy provides coverage for legal services and identity-protection services in response to incidents like this one. The county will be responsible for paying the policy deductible, which is approximately $25,000.

County Administrator Steve Howard authorized the procurement of the covered services immediately after learning of the data exposure; county commissioners are scheduled to decide on Tuesday whether to formally approve the agreements for those services.

Sheriff’s Office response and chain-of-custody actions

When the files were inadvertently forwarded beyond the initial recipient, the Sheriff’s Office contacted the two additional recipients to ensure the information received was deleted. That outreach is the only remediation step involving a law-enforcement actor described in the county’s account.

The sequence recorded in the public account is: an erroneous attachment sent by the records office, the recipient forwarding the file to two others, notification to county officials, Sheriff’s Office confirmation of deletion with the additional recipients, and then insurance and procurement actions initiated by county administration.

What this means for Citrus County employees, the County Commission, and county IT/security teams

• Citrus County employees and their families: Roughly 1,300 people had Social Security numbers exposed and are eligible for identity-protection services provided through the county’s cyber liability policy. The Sheriff’s Office contacted secondary recipients to confirm deletion of the file.
• County commissioners: Commissioners must decide whether to formally approve the agreements for legal and identity-protection services that County Administrator Steve Howard authorized immediately after the exposure was discovered.
• County IT and records staff: The incident was attributed to an insider error by the County Records Manager, who acknowledged failing to review attachments properly and subsequently lost his position. The episode underscores a need to address insider risk controls and review procedures for public-records responses.

This event did not involve a malicious external breach; it was the product of a human error in handling attachments to a public-records response. Still, the practical consequences are concrete: a vulnerable data set distributed beyond its intended recipient, Sheriff’s Office action to confirm deletion, immediate use of cyber insurance benefits, and an approximate $25,000 deductible that Citrus County taxpayers will likely cover if the commissioners approve the agreements.

The county’s next formal step is in the hands of the commissioners on Tuesday — a vote that will finalize whether the county proceeds with the services authorized by the administrator and accepts the insurer-covered response that triggers the deductible. Until then, the record is clear about what happened, who was affected, and what the county is seeking to do about it.

Original story