Remember getting a letter from the Maricopa County Community College District late last year?
More than two million of them went out warning people their personal information could have been exposed in a recent security breach.
But the ABC15 Investigators found some district employees knew about another security breach three years ago.
That information is in a letter sent to the New Hampshire Attorney General, warning some of their residents about the 2013 breach.
It gives background information many of you may have never heard about.
The letter says that back in January of 2011, the FBI informed a College District employee that "one or more" of their databases "were available for sale on the internet."
It says there was an internal investigation. The district even hired an outside security consultant.
But it claims management knew nothing about the incident then, because certain employees withheld information and obstructed the investigation.
Fast forward to 2013.
The district sent out millions of warnings about another breach, the one we all know about.
But there is no mention of what happened in 2011.
So, how did upper management not know about the investigations in 2011?
Were there any fixes at that time?
Could your personal information have been exposed three years ago?
These are questions we hoped to answer.
Two months ago, we submitted a public information request asking for all reports dealing with both the 2011 and 2013 breaches.
We still have not received the information.
But today, we did get a statement from MCCCD spokesman Tom Gariepy:
"Substantial progress has been made in analyzing the records. Because of the volume of requested information, we have hired an e-discovery vendor to help with the search for records, so we should be able to analyze the records requested by all parties once the e-discovery process is complete.
Meanwhile, here is a response to your questions dealing with specifics:
The Maricopa Community Colleges cannot respond publicly to these allegations. Based on the findings of an independent professional investigator, MCCCD initiated disciplinary action against several employees. Before action was recommended, each employee was afforded an opportunity to respond to the findings with additional information and perspective. Each employee requested and is entitled to a hearing before a final decision is made, and each has requested such a hearing. Advocates for some employees have attempted to make these personnel matters into public political issues: they have requested that the board stop the hearing process for these employees. However, MCCCD owes all affected employees a decision that is not influenced by publicity and politics. We cannot respond publicly to the allegations made by the advocates. The truth or falsity of those allegations will be tested in the hearing process, where all the evidence can be considered in context by an independent tribunal."
Here's the MCCCD attorney letter to the New Hampshire Attorney General from its website.