Fairfax County Police data breach exposed personal information of more than 1,700 employees in 2019

What happened

In November 2019, the Fairfax County Police Department in Virginia disclosed a data breach involving personal information of its employees. Early estimates put the number affected at more than 500. The department later traced the exposure to more than 1,700 sworn officers and civilian staff.

According to Police Magazine and The Washington Post, the exposed data included names, dates of birth, and Social Security numbers. Some reporting also cited bank account and medical information.

This was not an outside hack. The department described it as internal mishandling of records.

How the breach happened

The records reached Fairfax employees through a second jurisdiction. A Purcellville police employee who had formerly worked in Fairfax County attached a standard Fairfax County form to an email sent to Purcellville Police Chief Cynthia McAlister. That form carried a hidden field holding the employees' Social Security numbers.

Chief McAlister's email inbox was later copied onto a flash drive. Investigators said a former interim town manager, Alex Vanegas, removed the drive from Purcellville's Town Hall, and it went missing. The Washington Post reported that the data may have reached a convicted felon who claimed to hold the chief's entire inbox.

Officials said there were no confirmed reports at the time that the data had been misused. But that felon claim shows how far it had already traveled. Names, dates of birth, and Social Security numbers for more than 1,700 employees had moved outside the department's control, through another town and onto a lost drive.

Fairfax County runs the largest local police department in Virginia, which is part of why so many records were involved. Officer data lives in many systems: HR, payroll, training records, and internal affairs. Each is a place it can leak, and a leak does not need a hacker.

What this means for your own exposure

A roster of names, dates of birth, and Social Security numbers is linking data. Even without home addresses attached, those details let someone match an officer to the address, phone, and relative listings that data broker and people-search sites already sell.

Virginia gives covered officials one direct legal tool here. Under Va. Code Ann. § 18.2-186.4:1, a covered official — a judge, law-enforcement officer, or Commonwealth's attorney — can petition a circuit court for an order barring the state government from posting their home address, phone number, or personal email online. The court grants it only on a showing of a threat or a reasonable fear for the officer's safety or that of someone in their home. It is a real protection, but a narrow one. It applies to government publication, not to private data brokers, and it takes a court petition to invoke. New Jersey's Daniel's Law reaches brokers directly; Virginia's statute does not.

That leaves the broker listings themselves. Frontline Privacy finds those listings, files removal requests, and keeps checking for records that come back.