In February 2026, a certified payroll report in a Rome Common Council agenda packet went online with personal information for 36 Central Paving employees, including full Social Security numbers, home addresses, and pay details. The city took it down within two hours of being told. What happened next took seven months to piece together: five attempts to confirm the workers were notified, an email from one of them who never heard from the city, and public records showing signed acknowledgments for 18 of the 36.

This was very likely an honest mistake. The bigger question is what happens next time. The city says it has no data breach policy, and State Technology Law Section 208 requires one.