COVID test results and personal information of more than two dozen MTA employees was accidentally posted online in February by a third-party vendor, The Post has learned.
Letters were sent Wednesday to 31 transit workers whose names, genders, birthdays, phone numbers and COVID test results were publicly accessible for several days through the Bing search engine, sources said.
The tests were among 235,000 saliva tests conducted by Mount Sinai Hospital and its contractor Verbosity, which accepted responsibility for the accidental leak.
A forensic evaluation by Verbosity concluded that the information had been accessed just once — by a state Department of Health employee during a “routine” check on New York’s testing providers, according to an MTA official. Another 20 individuals unaffiliated with the MTA also had their test results publicly posted, the official said.
No Social Security information was published, and the information was only accessible through Bing, the MTA said. The workers impacted were mostly members of the Transport Workers Union Local 100, which reps city transit workers, according to transit officials.
The MTA has conducted COVID tests targeted at its unvaccinated employees since the fall to track the spread of the virus among its workforce.
Officials said the workers whose results were accidentally published include 24 employees of New York City Transit along with three from Long Island Rail Road, three from Bridges and Tunnels, two from MTA Bus Company and one MTA cop, officials said.
The document dump is the second data spill suffered by the MTA in recent months, after hackers who breached the network of MTA timeclock provider Kronos in December made off with the personal information of several current and former Metro-North employees.
Transit Authority servers were also breached by hackers with “suspected” ties to China last summer.
MTA communications director Tim Minton called the latest data snafu “unacceptable.”
“While it appears no employees’ personal information was actually accessed, some personal details relating to 31 MTA employees were potentially available for a short time on the internet and could have been publicly discovered,” Minton said in a statement.
“We are committed to protecting the privacy of MTA employees and are assured by Mount Sinai that it has taken necessary and effective remedial steps following discovery of the unintentional exposure.”
Representatives from Mount Sinai Hospital and Verbosity did not return requests for comment.
TWU Local 100 president Tony Utano said transit leaders need to take proactive steps to ensure workers’ data is not further compromised.
“We call on the MTA to redouble its efforts to ensure that information regarding transit workers is secure and not potentially accessible to identity thieves and other scammers,” Utano said. “This has to be a top priority.”