Hackers broke into the Federal Aviation Administration's computer system last week, accessing the names and Social Security numbers of 45,000 employees and retirees.
The agency said in a statement Monday that two of the 48 files on the breached computer server contained personal information about employees and retires who were on the FAA's rolls as of the first week of February 2006.
The server that was accessed was not connected to the operation of the air traffic control system and there is no indication those systems have been compromised, the statement said.
"The FAA is moving quickly to prevent any similar incidents and has identified immediate steps as well as longer-term measures to further protect personal information," the statement said. The agency said it is providing a toll-free number for employees "who believe they may be affected by the breach."
Tom Waters, president of American Federation of State, County and Municipal Employees Local 3290, said FAA officials told unions representing agency employees at a briefing Monday that the second breached file with personal information contained encrypted medical information.
"These government systems should be the best in the world and apparently they are able to be compromised," said Waters, an FAA contracts attorney. "Our information technology systems people need to take a long hard look at themselves and their capabilities. This is malpractice in their world."
The FAA statement said the data theft has been reported to "law enforcement authorities," who are investigating.
All affected employees will receive letters notifying them of the breach, the statement said.
Waters said FAA officials told union leaders the incident was the first of its kind at the agency. But he said his union complained about three or four years ago about an incident in which employees received anti-union mail that used names and addresses that appeared to be generated from FAA computer files.
He said the union complained to the FAA and the Transportation Department's inspector general but no action was taken.