FRONTLINEPRIVACY
Address exposure

Fairfax County Police data breach exposed personal info of about 500 sworn and civilian employees in 2019

2019-06-01·Fairfax County, Virginia

Personal information for roughly 500 Fairfax County Police employees, both sworn officers and civilians, was exposed in a 2019 internal data breach. The department notified affected employees and offered credit monitoring.

What happened

In mid-2019, Fairfax County Police Department disclosed that personal data for around 500 employees had been compromised. Police Magazine reported that the exposed information included names, dates of birth, and Social Security numbers for both sworn officers and civilian staff. Affected employees were notified and offered credit monitoring. The department described the breach as the result of internal mishandling of records.

What happened

In June 2019, Fairfax County Police Department in Virginia disclosed an internal data breach affecting approximately 500 sworn and civilian employees. According to Police Magazine, the exposed information included names, dates of birth, and Social Security numbers. The department notified those affected and offered credit monitoring.

The cause was reported as internal data handling, not an external intrusion. That detail matters. Officer data lives in lots of places: HR systems, training records, IA files, payroll. Each is a potential leak point.

How it started

Fairfax County is one of the largest jurisdictions in Northern Virginia and sits in the federal commuter belt. The department employs around 1,400 sworn officers. The 500-employee subset exposed in this breach reflects the volume of HR records routinely held by a department that size.

Officers in Northern Virginia work cases with significant federal nexus, including federal court details and protective work. A roster with DOBs and SSNs, even one without home addresses, gives an attacker the linking data they need to pull the rest from broker sites.

What this means for you

If you work in Northern Virginia, the public-records exemption (Va. Code Ann. § 2.2-3705.2) covers your home address in records held by the state. It does nothing about Whitepages, Spokeo, or BeenVerified. Virginia's Daniel's Law-style statute requires you to go to circuit court to block publication on the internet. That's a real lever, but a slow one.

The fast lever is removal at the broker. We do that, monitor, and re-do it. That's the deterrent that keeps a leaked HR file from translating into a permanent online address.


Editorial rules: Only public, already-reported incidents. Never name a non-public victim. Always end with the prevention takeaway tied to our service. Cite at minimum one public source per claim.

What would have prevented this

When 500 names, DOBs, and SSNs walk out of a department's own files, the secondary risk is not just identity theft. It's that the same data points get cross-referenced against people-search and broker pages to build address dossiers. Virginia's [Daniel's Law](/laws/daniels-law)-style statute (Va. Code Ann. § 18.2-186.4:1) lets covered officials petition a court to block publication, but the petition is reactive. The proactive work, removing existing broker listings, is what cuts the dossier off at the source.

Public sources