Sixty-nine boxes of copied burial records containing the personal information of people buried at Arlington National Cemetery were found this month at a private storage facility in Northern Virginia, cemetery officials told a congressional subcommittee Thursday.

The boxes were discovered by the manager of the facility, who went to clear out the unit after he had not received rental payment. When he noticed that the records belonged to Arlington, he called the cemetery.

The cemetery notified the Army’s Criminal Investigative Division, which is investigating how the records ended up in storage, said Kathryn Condon, director of the Army’s cemeteries program. Army officials reviewed the records — which contained the full names, Social Security numbers and dates of birth of veterans and family members buried with them — and said that the risk of anyone’s personal identification being compromised was low.

Condon said that the records found in the storage unit June 9 were duplicates meant to be digitized and that the cemetery has all of the originals.

An Army CID spokesman said that criminal investigators had returned all but one of the boxes to Arlington. He would not say why investigators were holding on to that box.

During the hearing, U.S. Rep. Bill Johnson (R-Ohio) said he found it “extremely troubling that boxes containing this kind of information were left unsecured and only discovered allegedly due to a lack of payment for the use of a storage facility. . . . I take this breach very seriously.”

Paul Stephens, policy director for the Privacy Rights Clearinghouse, a nonprofit agency that tracks security breaches, said the deceased soldiers’ personal information probably could not have been misused to open credit accounts or engage in identity theft.

“There really is not a security issue for an individual who is deceased,” he said. “Though I suppose people can always find a way to abuse information.” 

In general, Stephens said, soldiers’ deaths are updated regularly in the Social Security Administration’s death master file, and any attempt to use the number of a deceased person would be flagged during a bank review for credit.

The storage unit was being rented by an employee of a company that the cemetery had hired to digitize its burial records, cemetery officials said. Citing the investigation, they declined to identify the company.

An investigation by the Army inspector general last year found that the cemetery had paid millions to a few companies in failed attempts to create a digital database of its paper records.

Condon said the cemetery had not notified the public about the find because the records belonged to the dead and the Social Security numbers “are no longer in use.”

“If there was a potential where we thought that there was current personal identifying information, we would have immediately notified not only the families but put out a press release,” she said.

Previously, CID had investigated allegations of conflicts of interest between Arlington personnel and a civilian contractor and referred its findings to the U.S. attorney, but prosecutors did not pursue charges.