Major League Lacrosse data leak: Personal details and social security numbers of players exposed

Major League Lacrosse accidentally exposed the personal information of every player in its player pool, including their Social Security numbers, in a massive data leak. In an email sent to current players notifying them about the "data incident", the league said they discovered a link to their player pool registration that inadvertently linked to an excel spreadsheet that contained players' sensitive personal data.

The exposed data sheet included players' full names, addresses, telephone numbers, email addresses, Social Security numbers, citizenship, dates of birth, height, weight, position, college, graduation year, team and non-MLL occupation.

MLL said the incident occurred last Wednesday (23 August). The league became aware of the exposed information the next day and "immediately" disabled the link and began an investigation into the incident.

"We take the privacy and protection of your information very seriously," the league said in the email, Deadspin first reported. "Although the investigation has just begun and is very much ongoing, given the sensitive nature of the information, we wanted to notify you of the incident now. We will be sending you a formal notice once further information is learned, including access to prepaid credit monitoring."

The league also recommended players place a credit freeze on their accounts and file a complaint with the Federal Trade Commission should they become a victim of identity theft.

"We realize that this is a lot of information, but we wanted to provide you with immediate steps that you can take to protect yourself while this investigation is ongoing," the league said. "You will receive further information as it is discovered."

Many past and current players took to social media to voice their anger and frustration over the breach saying they were only notified about the incident on Monday at 5:30pm – four days after the league discovered the breach.

"This is unacceptable and inexcusable," Ryan Flanagan, a defender for the New York Lizards and member of the MLL players' council, told Inside Lacrosse. "The spreadsheet that was shared publicly with player information has been shared privately on more than one occasion.

"Players have previously requested that the file not be shared with anyone and that any files with player information be encrypted and password protected. This request was clearly ignored."

He also pointed out the time gap between the discovery of the breach and notification of players affected.

"The individuals that were aware of the information breach went home for the weekend without making the players aware that their personal information was shared publicly. This is unacceptable," Flanagan said.

"The players of Major League Lacrosse have continued to create an outstanding on-field product for fans and deserve better treatment off-the-field in a variety of areas, including the protection of our personal information."

IBTimes UK has reached out to MLL for comment.