A government department already under fire is trying to explain what veterans groups are calling a serious security lapse.

A worker improperly took some information home and now thieves have a computer disk with sensitive personal data on millions of U.S. veterans. The worker's home was burglarized and the disk was stolen. The government said the data contained identifying information including names, Social Security numbers, and dates of birth for up to 26.5 million veterans and some spouses, as well as some disability ratings.

The affected data did not include any of VA's electronic health records nor any financial information, the government said.

The information involved mainly those veterans who served and have been discharged since 1975. Data of veterans discharged before 1975 who submitted claims to the agency may have been included.

VA Secretary Jim Nicholson said there's no evidence the thieves used the data for identity theft, and an investigation continues. He said the thieves may not know what they have. Authorities believe it is unlikely the burglars targeted the items because of any knowledge of the data contents and said it's possible that they remain unaware of the information that they possess or of how to make use of it.

The department has come under criticism for shoddy accounting and for falling short on the needs of veterans. Last year, more than 260,000 veterans could not sign up for services because of cost-cutting.

Nicholson said he doesn't know how many of the department's employees undergo background investigations. He said employees who have access to large volumes of personal data should be required to.

Veterans advocates expressed alarm. Bob Wallace, executive director of Veterans of Foreign Wars called it "a very serious breach of security for American veterans and their families."

The incident involved a midlevel data analyst who had taken the information home to suburban Maryland on a laptop to work on a department project earlier this month. The residential community had been a target of a series of burglaries when the employee was victimized earlier this month, according to the FBI in Baltimore. Local law enforcement and the VA inspector general were also investigating.

Nicholson said he does not believe the VA employee was involved in the theft, but the man has been placed on administrative leave pending the outcome of an investigation

Sen. John Kerry, D-Mass., who is a Vietnam veteran, said he would introduce legislation to require the VA to provide credit reports to the veterans affected by the theft.

The VA will send out individual notification letters to veterans and has set up a call center and Web site, www.firstgov.gov, for veterans who believe their information has been misused. That toll free number is 1-800-FED INFO (1-800-333-4636). The government said the call center will operate from 8 am to 9 pm (EDT), Monday-Saturday as long as it is needed.

What To Do?

Although there is no evidence any missing data has been used illegally, the Department of Veterans Affairs is asking all veterans to be extra vigilant and to carefully monitor bank statements, credit card statements and any statements relating to recent financial transactions. Those who may notice unusual or suspicious activity are asked to report it immediately to the financial institution involved and contact the Federal Trade Commission for further guidance.

The VA said it does not believe that it is necessary for veterans to contact financial institutions or cancel credit cards and bank accounts, unless they detect suspicious activity.

The Federal Trade Commission recommends the following four steps for those who detect suspicious activity:

Step 1 -- Contact the fraud department of one of the three major credit bureaus:

Equifax: 1-800-525-6285; www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241
Experian: 1-888-EXPERIAN (397-3742); www.experian.com; P.O. Box 9532, Allen, Texas 75013
TransUnion: 1-800-680-7289;www.transunion.com; Fraud Victim Assistance Division, P.O. Box 6790, Fullerton, CA 92834-6790

Step 2 -- Close any accounts that have been tampered with or opened fraudulently.

Step 3 -- File a police report with your local police or the police in the community where the identity theft took place.

Step 4 -- File a complaint with the Federal Trade Commission by using the FTC's Identity Theft Hotline by telephone: 1-877-438-4338, online at www.consumer.gov/idtheft, or by mail at Identity Theft Clearinghouse, Federal Trade Commission, 600 Pennsylvania Ave. NW, Washington DC 20580.