Thread: CA state worker probed in ID security breach/Mex Mafia link

California state worker probed in ID security breach
By Andrew McIntosh - amcintosh@sacbee.com

Published 12:14 am PDT Thursday, July 10, 2008
Story appeared in MAIN NEWS section, Page A4

Print | E-Mail | Comments (13) |

A state worker recently married to a member of the Mexican Mafia who is in Corcoran State Prison for a gang murder is herself under investigation for downloading more than 5,000 names, addresses and Social Security numbers belonging to Department of Consumer Affairs staff, The Bee has learned.

The Department of Consumer Affairs disclosed that it suffered a data security breach last month, but at the time released few details about the incident.

Officials sent a letter to employees, warning them to watch their credit for signs of identity theft, offering them free credit reports and $25,000 worth of fraud insurance.

Court documents obtained by The Bee show the department's own investigators have raided the Sacramento home of Rachael Rivas Dumbrique, a 32-year-old former Consumer Affairs personnel specialist, as part of an ongoing criminal investigation.

Investigators are looking at why Dumbrique copied a confidential data roster with employee names, addresses and Social Security numbers and then shipped it to a private e-mail account on her last day of work at Consumer Affairs in June. They also want to know if her gang-linked husband had any involvement, the court documents show.

Dumbrique has since joined the Department of Mental Health, where she was at work Wednesday as a staff services analyst in the department's personnel office, spokeswoman Kirsten Deichert confirmed. She declined further comment.

The criminal probe is described in a six-page affidavit that Consumer Affairs investigator Mark Loomis filed in Sacramento Superior Court on June 12.

Loomis used the affidavit to obtain a search warrant used to raid Dumbrique's Sacramento home on June 13.

Investigators seized two computers and marijuana from the house, but didn't arrest her. It is unclear from the court documents whether they recovered the improperly disclosed data.

Dumbrique did not respond to several e-mail or telephone messages seeking her comment, but she suggested in an e-mail to her former bosses on June 11 that she sent the data file to her personal e-mail account by mistake.

Consumer Affairs investigators also seized an envelope in a bedroom closet after finding it contained unspecified "confidential California Department of Corrections and Rehabilitation materials" along with three state identification cards, according to a report about the search filed with Superior Court after the raid.

Russ Heimerich, a spokesman for Consumer Affairs, said Wednesday that the investigation is ongoing and no charges have been filed. "That's not to say that there might not be, when we have all the information we need," Heimerich added.

The California Highway Patrol, which has primary authority for investigating suspected computer crimes at state agencies, was formally notified of the breach June 9 as required by state law, but Consumer Affairs has its own peace officers and is handling the investigation, said CHP spokeswoman Fran Clader.

The affidavit by Consumer Affairs investigator Loomis claims that Dumbrique downloaded the data – called an "an Alpha roster" inside Consumer Affairs because it has names and data on all employees, retired annuitants and members of all its regulatory oversight boards – on Friday, June 6.

She then reportedly forwarded the roster, as an attachment, to her own personal Yahoo e-mail account, the affidavit adds.

Special security software alerted Consumer Affairs data security officials to the breach that same day, but the department's criminal probe only began Monday, June 9. There was no explanation for the two-day delay, other than it was a weekend.

Consumer Affairs data security experts and Dumbrique's former bosses in the human resources unit told Loomis that Dumbrique had access to the confidential data on a daily basis as a regular part of her job, the affidavit states.

But the personnel specialist did not have a valid reason to download the data nor did she have permission to transmit it to an outside e-mail account, the affidavit adds.

Consumer Affairs investigators became alarmed when they learned from Dumbrique's boss, Yolanda Alvarez, that the recently departed worker was married in November to a convicted felon now serving time in a state prison, the affidavit states.

A search of Dumbrique's former hard drive at Consumer Affairs found her state computer was used to correspond with Edward Dumbrique, who was convicted of murder for his role in a drive-by slaying in Los Angeles County in 1997.

Edward Dumbrique was sentenced to 25 years for the killing of Antonio Alarcon with a semi-automatic pistol from the back seat of a car.

The state worker married Edward Dumbrique at Corcoran State Prison on Nov. 17, 2007, according to marriage records filed with the Kings County Clerk's Office, the affidavit stated. Loomis also stated that he spoke to a member of the Corcoran prison staff's institutional gang investigations unit, identified as Sgt. Gomez, who told him that Dumbrique was "a validated member of the Mexican Mafia."

"Sgt. Gomez stated that based on his experience, it was not unusual for inmates to manipulate outside individuals for further criminal enterprises," Loomis states in the affidavit.

A day after the investigator spoke to prison officials but before the house was raided, Rachael Dumbrique sent an e-mail to Alvarez, her former boss at Consumer Affairs. The e-mail suggested that the roster with names, home addresses and Social Security numbers "may have been one of the documents I e-mailed" to her house.

Dumbrique's e-mail then added, according to the affidavit by Loomis, that had she "known that it contained information such as Social Security numbers, I would have NEVER sent it to my home e-mail address."

But Alvarez told the Consumer Affairs investigator Loomis that she didn't believe Dumbrique, saying that Dumbrique knew what the roster contained and had daily access to it and that it was "highly unlikely" that she would have inadvertently attached it to an e-mail.

The employee roster was maintained in a network folder separate from an employee name and telephone list that Dumbrique also copied and e-mailed to her personal Yahoo account as an attachment, Alvarez told the Consumer Affairs investigator.
http://www.sacbee.com/capolitics/story/1072332.html

Investigators are looking at why Dumbrique copied a confidential data roster with employee names, addresses and Social Security numbers and then shipped it to a private e-mail account on her last day of work at Consumer Affairs in June. They also want to know if her gang-linked husband had any involvement, the court documents show.

Dumbrique has since joined the Department of Mental Health, where she was at work Wednesday as a staff services analyst in the department's personnel office, spokeswoman Kirsten Deichert confirmed. She declined further comment.

Great! Instead of firing this woman, she just transfers to another state agency! Are these the type of people working for the state of California! I wonder how many other state employees who may have ties to the illegal invader community ( anchor babies) and who might also have access to this type of information? This is exactly how it happens! This is how people get their identities stolen.

You think this woman with the help of her mexican mafia, convicted felon husband were going to sell those social security numbers and personal information to illegals?

State agency acts to shield employees from ID theft
By Andrew McIntosh - amcintosh@sacbee.com
Published 12:00 am PDT Friday, July 11, 2008
Story appeared in MAIN NEWS section, Page A3

Print | E-Mail | Comments (|

The massive data security breach at the Department of Consumer Affairs last month could cost taxpayers as much as $122,000, state officials said Thursday.

That's how much the department may have to spend to provide identity theft protection services to more than 5,000 employees whose private information was compromised, department spokesman Russ Heimerich said.

Consumer Affairs workers affected are being provided free credit monitoring, fraud insurance and toll-free access to identity theft restoration agents if their identities are misused over the next year, an internal memo to affected staff says.

CSIdentity of Austin, Texas, was awarded a contract to provide the services after the June 9 breach. Consumer Affairs workers must enroll to get the services, and the company's final fee will depend on how many sign up.

But state officials on Thursday urged all employees affected to sign up and review their credit reports for the next year and report irregularities to police. None has been reported so far.

The Bee reported Thursday that Consumer Affairs' investigators raided the home of former personnel analyst Rachael Dumbrique, 32, after she downloaded an internal "alpha data roster" containing names and Social Security numbers for more than 5,000 department workers. Dumbrique forwarded the file to her Yahoo e-mail account, triggering a state security software alert, court documents show.

Dumbrique did not respond to Bee requests for comment, but she told state officials in an e-mail that she didn't realize the file had Social Security numbers in it.

Consumer Affairs security officials became alarmed after learning that she had married a member of the Mexican Mafia now serving 29 years in Corcoran State Prison for murder, according to an affidavit investigator Mark Loomis used to get a search warrant.

Dumbrique is alleged to have downloaded the file on her last day of work as a personnel specialist at Consumer Affairs before taking a human resources job at the Department of Mental Health.

Consumer Affairs workers were furious that details of the probe were kept under wraps, while Bee readers demanded to know why Dumbrique was still at work while under criminal investigation for a security breach.

Mental Health Department officials declined to say if Dumbrique was at work Thursday or discuss what precautions, if any, have been taken to safeguard their personnel data.

Department spokeswoman Nancy Kincaid offered only a prepared statement: "We are confident that there is no compromise of any Department of Mental Health information in any way. This is a personnel issue and because of things involved, there's nothing else we can say."

The Bee reported the security breach included addresses, but Consumer Affairs says no addresses were included, but rather "various other public information."

About the writer:
Call The Bee's Andrew McIntosh, (916) 321-1215.
http://www.sacbee.com/capolitics/story/1075544.html