The Odessa, Texas, government had a data breach. It’s decided to be open about what’s going on, even though what’s going on is a little odd and perhaps mixed up in ugly local politics or, at least, a personnel matter. Given that many questions still circle the situation, it’s especially noteworthy for the government to come out with what it knows.

When to announce a data breach is always tricky. State requirements are vague and it’s often difficult to know if you’ve in fact been breached, if any data has been taken or what the extent of the damage is. In Odessa’s case, you also have the issue that government should be more open than private companies.

The city, population about 114,000, discovered the breach July 12 when it was conducting a search in response to a public-information request for documents. The search made the city realize that the email account of the city attorney it fired in December had not been deactivated and had been accessed several times since then (as recently as last week).

Within, Without

On Monday this week, Odessa Mayor Javier Joven held a press conference (pictured) to announce all this. He said the city didn’t yet know exactly what happened, or “if the breach happened within or without” or “without the authorization or knowledge of the former employee, or was it with the direct actions of the former employee.”

About 200 emails were forwarded from the city email account to a private account, and some of the city’s systems were tapped into, the mayor said. Information accessed includes personnel data and police reports.

After the presser on Monday, the City Council held a special meeting on the breach at which the mayor read an affidavit outlining the situation (a post on the city’s Facebook page that included the affidavit started with the line “Mayor working to be transparent”). After an executive session, the council emerged and announced it had reached a consensus to ask the police to investigate. The mayor said criminal charges could be brought if warranted.

Legal Claim

To complicate things, the fired city attorney has hired a lawyer who has said his client intends to file a legal claim against the city for her termination. In comments to the Odessa American, he suggested the data-breach allegation was an act of retaliation against his client. He said the mayor, unusually, held a press conference about an internal employee matter.

So, while the transparency is good, this continues to be messy. Mayor Joven said the city will conduct an investigation to uncover what protocols were neglected to lead to such a situation and to prevent a repeat.

That would be good.

Image Credit: City of Odessa via Facebook

Sign up for our free weekly newsletter on crisis communications. Each week we highlight a crisis story in the news or a survey or study with an eye toward the type of best practices and strategies you can put to work each day. Click here to subscribe.