Full Breakdown
Labor Department Data Breach Exposes Disability Accommodation Requests
8/28/2026, 4:35:16 AM
Core Event
On July 22, the U.S. Department of Labor learned that a spreadsheet containing personally identifiable information (PII) and protected health information (PHI) from employees’ reasonable-accommodation (RA) requests was sent from an authorized employee’s work account to a personal email address outside the department’s domain. The employee had legitimate access for job duties but lacked authority to forward the data.
Background & Context
The department has been struggling with a backlog of hundreds of RA requests, with some employees waiting months or over a year for decisions.
Scope of Exposed Information
The disclosed spreadsheet listed each applicant’s first and last name, duty location, work email, job title, supervisor name and email, pay grade, and series. It also included functional-limitation categories such as dexterity/mobility issues, low vision or blindness, physical disability, deafness or hard of hearing, mental health, cognitive learning disability, chronic health condition, and pregnancy. No Social Security Numbers, dates of birth, detailed medical diagnoses, medical documents, or additional financial data were included.
Official Statements & Responses
Naomi Berry-Perez, director of the department’s Civil Rights Center, said the Labor Department is assessing the incident’s scope, undertaking remediation to recover and destroy the data, and reviewing safeguards. She added that further notifications will be issued if additional PII/PHI are found or new protective steps are identified. The agency also indicated plans to deploy artificial-intelligence tools to triage the accommodation backlog, though experts warned that processing confidential medical records through AI could raise further privacy concerns.
Verbatim Quotes
- “The individual had authorized access to the information in the performance of their DOL duties. However, the individual did not have the authority to send the information to a personal email address,” — Naomi Berry-Perez, director of the department’s Civil Rights Center
- “DOL is currently assessing the scope and impact of these related incidents. DOL is engaging in remediation activities to recover and destroy all the information involved,” — Naomi Berry-Perez, director of the department’s Civil Rights Center
- “If DOL determines that additional categories of PII/PHI left the DOL domain, verifies additional incidents where your information has been disclosed, or identifies additional recommended steps that may safeguard your information, additional notifications will be provided,” — Naomi Berry-Perez, director of the department’s Civil Rights Center
- “No Social Security Numbers (SSNs), dates of birth (DOBs), more specific medical diagnoses beyond the above-listed functional limitations, medical documents, or additional financial information were included in this spreadsheet,” — Naomi Berry-Perez, director of the department’s Civil Rights Center
