Boone County looks to remove auditor after data leak

BOONE COUNTY, Ind.–Boone County is looking at removing county auditor Debbie Crum after an internal investigation revealed she emailed personal information for all 290 Boone County employees to the Indiana Department of Child Services.

A public hearing is scheduled for Tuesday, October 6 at 10:00 am.

“Evidence in this matter will be presented at that time by County Attorney Beth Copeland,” said Boone County Communications Director Brent Wheat. “By statute, no decision on the matter can be made at the hearing.  After the applicable waiting period, the boards then may consider whether to petition the court for removal.”

The county has also hired Taft Law Firm to advise them on the matter, with an appropriation not to exceed $25,000, Wheat said.

Crum has not yet responded to requests for comment.

The data leak happened on June 30.

An internal investigation revealed auditor Debbie Crum emailed personal information for all 290 Boone County employees to the Indiana Department of Child Services.

Weeks later, a DCS employee emailed that document to four Boone County employees and two county vendors “for reasons that remain unknown,” according to Boone County.

Boone County completed its internal investigation into the disclosure of names and Social Security numbers to unintended recipients.

Here’s a breakdown of what Boone County’s investigation found:

• In May 2026, the Indiana Department of Child Services (DCS) initiated its annual audit of the County’s financial records by contacting Boone County Auditor Debbie Crum.
• As part of the audit, DCS requested documentation related to certain employees whose work involves child support services, according to Boone County.
• After an initial report was emailed by Crum that did not contain the requested information, a DCS employee sent a follow-up email identifying to Crum the 12 specific employees whose records were needed for the audit.
• In response, Auditor Crum requested the Boone County Human Resources Department provide her a report of all employees enrolled in the County’s long-term disability plan.
• The request did not include the context or purpose of the request, according to Boone County.
• HR generated the requested report and placed it on the County’s secured network drive for retrieval by the Auditor’s Office.
• On June 30, Auditor Crum retrieved the report and emailed it to two DCS employees—without opening or reading the report first, according to Boone County.
• Rather than containing information limited to the 12 employees identified by DCS, the report included personal information for all 290 employees enrolled in the County’s long-term disability plan, including names and Social Security numbers.
• Approximately three weeks later, one of the DCS employees forwarded the email to four Boone County employees and two county vendors for reasons that remain unknown. Boone County officials discovered the disclosure at this point.

Indiana’s I-Team broke the story about the employee data disclosure.

“Boone County recognizes the seriousness of any unauthorized disclosure involving employees’ personal information,” said Boone County in a statement to Indiana’s I-Team. “Protecting confidential information is a fundamental responsibility, and County officials regret that this incident occurred.”

The County says it is implementing safeguards to strengthen internal procedures governing the handling and transmission of sensitive employee information.

“The County is also taking measures to support those employees with resources to help protect their personal information, including credit monitoring and identity protection services,” said the county in a statement.

“County employees have every right to expect that their personal information will be handled with care, accuracy and accountability, and shared only when necessary,” said Boone County Commission President Tim Beyer. “Our investigation found that substantially more information than was requested was disclosed. We are committed to strengthening our procedures, supporting our employees, and taking appropriate action to ensure an incident like this does not happen again.”

Boone County is encouraging employees to review their credit reports and financial accounts for suspicious activity.

Employees should also consider placing a fraud alert or security freeze on their credit files, according to the email sent to Boone County employees.

“County employees deserve full confidence that their personal information is handled responsibly. The Council is committed to supporting affected employees while carefully reviewing the findings of this investigation and considering any actions necessary to protect the integrity of county government,” said Boone County Council President Jennifer Hostetter.

Indiana’s I-Team contacted Indiana DCS for comment and the agency provided the following statement:

The Indiana Department of Child Services (DCS) takes very seriously the protection of the information entrusted to us in providing services.

On July 21, 2026, DCS’ Child Support Bureau learned that data in its custody was inadvertently disclosed by email to both internal and external parties. While this information was originally provided to CSB by the Boone County Auditor for use in CSB’s ordinary course of business, it included additional data that the agency should not have received. 

DCS took immediate action to control the situation and is closely following state and federal protocols, including adhering to Indiana Code 24-4.9-3-1, commonly referred to as the “Indiana Security Breach Notification Statute.”

About The Author

See author's posts