Major League Lacrosse Accidentally Released Its Players' Social Security Numbers
Major League Lacrosse apparently has an Excel spreadsheet thing that lists the full name, address, telephone number, email address, Social Security number, citizenship, date of birth, height, weight, position, college, graduation year, team, and non-MLL occupation of each player in its player pool. That's kind of weird in its own right—why have so much crucial information in one place instead of spreading it out to protect against the worst?
The MLL Players' Council apparently thought the same thing, as they say they requested the information be encrypted and password-protected. This is all in case of an absolute catastrophe, of course, and absolute catastrophes don't happen too often.
Well, an absolute catastrophe happened. The one thing that can't happen when you have a ton of highly sensitive information in one place happened: the information leaked. It freakin' leaked. All of it. The link to the spreadsheet was made public before MLL personnel noticed something was wrong (ya think?!) and took it down.
New York Lizard defender and MLL Players' Council member Ryan Flanagan, who plays for the New York Lizards, provided this statement to Inside Lacrosse:
"This is unacceptable and inexcusable. The spreadsheet that was shared publicly with player information has been shared privately on more than one occasion. Players have previously requested that the file not be shared with anyone and that any files with player information be encrypted and password protected. This request was clearly ignored. On top of that, the issue of player information being shared publicly was brought to the attention of the league on Aug. 23. The league did not send a note to those impacted until Aug. 28. The individuals that were aware of the information breach went home for the weekend without making the players aware that their personal information was shared publicly. This is unacceptable.
"We greatly appreciate Commissioner Gross offering prepaid credit monitoring to those impacted. However, the players of Major League Lacrosse have continued to create an outstanding on-field product for fans and deserve better treatment off-the-field in a variety of areas, including the protection of our personal information."
Major League Lacrosse gave its own statement to the Lax Sports Network:
"The players are the ones impacted. Major League Lacrosse will communicate directly to the players to make sure they are receiving the most accurate information. Player social security numbers only exist in a secure location. We are judiciously working on a contract with a reputable company to set up long-term credit protection solution for all impacted players. The immediate step outside of long-term protection solution, is that all social security numbers have been removed from spreadsheets and other documentation."
According to Inside Lacrosse, players were noticed of the gaffe by e-mail and were instructed to "establish free 90-day fraud alerts with the three credit reporting bureaus” and “consider placing a credit freeze on accounts which will make it more difficult for someone to open an account.” Players were also given instructions on how to file a fraud complaint with the FTC.
Predictably, MLL players past and present were not pleased.
MLL's 17th season wrapped up on Aug. 19, when the Ohio Machine beat the Denver Outlaws to win the Steinfeld Cup.
