July 10, 2008
California State Worker Probed in ID Security Breach
By Andrew McIntosh, The Sacramento Bee, Calif.
Jul. 10--A state worker recently married to a member of the Mexican Mafia who is in Corcoran State Prison for a gang murder is herself under investigation for downloading more than 5,000 names, addresses and Social Security numbers belonging to Department of Consumer Affairs staff, The Bee has learned.The Department of Consumer Affairs disclosed that it suffered a data security breach last month, but at the time released few details about the incident.
Officials sent a letter to employees, warning them to watch their credit for signs of identity theft, offering them free credit reports and $25,000 worth of fraud insurance.
Court documents obtained by The Bee show the department's own investigators have raided the Sacramento home of Rachael Rivas Dumbrique, a 32-year-old former Consumer Affairs personnel specialist, as part of an ongoing criminal investigation.
Investigators are looking at why Dumbrique copied a confidential data roster with employee names, addresses and Social Security numbers and then shipped it to a private e-mail account on her last day of work at Consumer Affairs in June. They also want to know if her gang-linked husband had any involvement, the court documents show.
Dumbrique has since joined the Department of Mental Health, where she was at work Wednesday as a staff services analyst in the department's personnel office, spokeswoman Kirsten Deichert confirmed. She declined further comment.
The criminal probe is described in a six-page affidavit that Consumer Affairs investigator Mark Loomis filed in Sacramento Superior Court on June 12.
Loomis used the affidavit to obtain a search warrant used to raid Dumbrique's Sacramento home on June 13.
Investigators seized two computers and marijuana from the house, but didn't arrest her. It is unclear from the court documents whether they recovered the improperly disclosed data.
Dumbrique did not respond to several e-mail or telephone messages seeking her comment, but she suggested in an e-mail to her former bosses on June 11 that she sent the data file to her personal e-mail account by mistake.
Consumer Affairs investigators also seized an envelope in a bedroom closet after finding it contained unspecified "confidential California Department of Corrections and Rehabilitation materials" along with three state identification cards, according to a report about the search filed with Superior Court after the raid.
Russ Heimerich, a spokesman for Consumer Affairs, said Wednesday that the investigation is ongoing and no charges have been filed. "That's not to say that there might not be, when we have all the information we need," Heimerich added.
The California Highway Patrol, which has primary authority for investigating suspected computer crimes at state agencies, was formally notified of the breach June 9 as required by state law, but Consumer Affairs has its own peace officers and is handling the investigation, said CHP spokeswoman Fran Clader.
The affidavit by Consumer Affairs investigator Loomis claims that Dumbrique downloaded the data -- called an "an Alpha roster" inside Consumer Affairs because it has names and data on all employees, retired annuitants and members of all its regulatory oversight boards -- on Friday, June 6.
She then reportedly forwarded the roster, as an attachment, to her own personal Yahoo e-mail account, the affidavit adds.
Special security software alerted Consumer Affairs data security officials to the breach that same day, but the department's criminal probe only began Monday, June 9. There was no explanation for the two-day delay, other than it was a weekend.
Consumer Affairs data security experts and Dumbrique's former bosses in the human resources unit told Loomis that Dumbrique had access to the confidential data on a daily basis as a regular part of her job, the affidavit states.
But the personnel specialist did not have a valid reason to download the data nor did she have permission to transmit it to an outside e-mail account, the affidavit adds.
Consumer Affairs investigators became alarmed when they learned from Dumbrique's boss, Yolanda Alvarez, that the recently departed worker was married in November to a convicted felon now serving time in a state prison, the affidavit states.
A search of Dumbrique's former hard drive at Consumer Affairs found her state computer was used to correspond with Edward Dumbrique, who was convicted of murder for his role in a drive-by slaying in Los Angeles County in 1997.
Edward Dumbrique was sentenced to 25 years for the killing of Antonio Alarcon with a semi-automatic pistol from the back seat of a car.
The state worker married Edward Dumbrique at Corcoran State Prison on Nov. 17, 2007, according to marriage records filed with the Kings County Clerk's Office, the affidavit stated. Loomis also stated that he spoke to a member of the Corcoran prison staff's institutional gang investigations unit, identified as Sgt. Gomez, who told him that Dumbrique was "a validated member of the Mexican Mafia."
"Sgt. Gomez stated that based on his experience, it was not unusual for inmates to manipulate outside individuals for further criminal enterprises," Loomis states in the affidavit.
A day after the investigator spoke to prison officials but before the house was raided, Rachael Dumbrique sent an e-mail to Alvarez, her former boss at Consumer Affairs. The e-mail suggested that the roster with names, home addresses and Social Security numbers "may have been one of the documents I e-mailed" to her house.
Dumbrique's e-mail then added, according to the affidavit by Loomis, that had she "known that it contained information such as Social Security numbers, I would have NEVER sent it to my home e-mail address."
But Alvarez told the Consumer Affairs investigator Loomis that she didn't believe Dumbrique, saying that Dumbrique knew what the roster contained and had daily access to it and that it was "highly unlikely" that she would have inadvertently attached it to an e-mail.
The employee roster was maintained in a network folder separate from an employee name and telephone list that Dumbrique also copied and e-mailed to her personal Yahoo account as an attachment, Alvarez told the Consumer Affairs investigator.
To see more of The Sacramento Bee, or to subscribe to the newspaper, go to http://www.sacbee.com/.
Copyright (c) 2008, The Sacramento Bee, Calif.
Distributed by McClatchy-Tribune Information Services.
For reprints, email [email protected], call 800-374-7985 or 847-635-6550, send a fax to 847-635-6968, or write to The Permissions Group Inc., 1247 Milwaukee Ave., Suite 303, Glenview, IL 60025, USA.