Anchorage Police Department exposed unredacted traffic-collision reports for 11,402 people in 2021

What happened

APD's report-writing system was set up to redact dates of birth and driver's-license numbers from the public copies of traffic-collision reports before those copies were uploaded to LexisNexis, a public-records service. A redaction setting was turned off. For nearly two years, from April 2019 through February 2021, the department uploaded unredacted reports covering 11,402 people. Each report tied a name to a full date of birth and a driver's-license number, two of the data categories protected under the federal Driver's Privacy Protection Act.

APD disclosed the exposure in June 2021. It stopped the uploads, pulled the reports from LexisNexis, and hired a vendor to notify the affected people and offer free credit monitoring.

In January 2026, a separate event brought the 2021 leak back into coverage. APD took servers offline and cut off access for a Utah-based software vendor, White Box Technologies, after that vendor was targeted in a cyberattack. The department said it found no evidence that its own systems were compromised in the 2026 event. The 2021 traffic-report exposure remains the confirmed personal-data leak in Anchorage's recent record.

How it started

Police agencies release redacted collision reports as a routine matter for insurance claims and public records. The failure in Anchorage was procedural. The automatic redaction that strips dates of birth and license numbers from public copies was switched off, and no one caught it for close to two years.

Once the unredacted reports were on LexisNexis, anyone with access could read a full date of birth and driver's-license number next to a name. That combination is what data brokers and identity-theft operations look for, because it links cleanly to name-and-address records. Pulling the reports back does not undo copies already made. Data that circulated has to be treated as still out there.

What this means for you

If you are a sworn officer, dispatcher, or civilian employee in Alaska, and your information sits in any police-agency record, the 2021 APD exposure is the case to study. Alaska has no Daniel's Law analog. Its general public-records law, AS 40.25.120(a)(6), lets an agency withhold law-enforcement records when disclosure could reasonably be expected to endanger someone's safety, but that is a discretionary, case-by-case exemption, not an automatic shield for your personal details.

The federal DPPA restricts how personal information from motor-vehicle records can be released and used. It lets you sue for misuse of that data, with liquidated damages of at least $2,500 per violation. Frontline Privacy does not file DPPA claims; that is work for a lawyer. What we do is the upstream part: we scan data-broker sites for your home address and personal details, file removals where they appear, and keep re-checking so the same records are harder to reassemble. We handle most of that process and tell you clearly when a site needs something from you.