You can now read 10 articles in a month for free on BostonGlobe.com. Read as much as you want anywhere and anytime for just 99¢.

The Boston Globe

Business

Online order brings sensitive data instead

Mass. resident gets employees’ records, not a tie, from Gap

SAN FRANCISCO — With a little more than two weeks to go before their wedding, Emily Dreyfuss’ fiance ordered a tie and pocket square from Gap chain Banana Republic’s website to go with his Navy blue suit.

What the couple got in the mail instead Thursday would make an identity thief giddy: the confidential files of about 20 former employees, including Social Security numbers and W4 tax forms.

Continue reading below

‘‘We totally laughed,’’ Dreyfuss, 29, said from her Cambridge, Mass. home

She had misgivings about the package as soon as it arrived. It was very heavy and did not say Banana Republic, but Gap Inc.

She and her fiance have been buying each other presents, and she thought it may have been a really heavy piece of clothing with catalogs, said Dreyfuss, the daughter of actor Richard Dreyfuss.

‘We’re taking immediate action to evaluate and strengthen our processes to prevent mis-mailings in the future and apologize for the error.’

Quote Icon

When they opened the package, inside were three folders sealed with tape and labeled ‘‘HR Administration.’’ They contained tax and Social Security information as well as handwritten resignation letters, doctors’ notes, and salary information — seemingly the employees’ entire record at the company. The employees were sales support associates and at least one made $9 an hour, Dreyfuss said.

The resignation letters were mostly from March and addressed formally to ‘‘Ms.’’ and then the person’s first name. They were polite and positive, expressing thanks for the chance to work for the company and learning so much. Some ended by saying, ‘‘God Bless.’’

Dreyfuss, who runs the home page and also writes for technology website, CNET, said she did not look through everything.

‘‘I got a queasy feeling and felt like I should stop looking at this,’’ she said.

San Francisco-based Gap Inc. blamed the mix-up on a human mistake. ‘‘We’re taking immediate action to evaluate and strengthen our processes to prevent mis-mailings in the future and apologize for the error,’’ spokeswoman Edie Kissko said.

Dreyfuss said a Banana Republic representative has since responded to a tweet about the mix-up and apologized for what he called a ‘‘horrible mistake.’’

He said clothing and employee information is sent out in the same type of gray plastic bag. The employee information appears to have been mislabeled in this case. The representative said the store would look into what went wrong and inform the former employees, Dreyfuss said. They will send her a self-addressed, stamped envelope to return the information in.

Dreyfuss said the episode with Banana Republic raises concerns about how well the company is safeguarding customer information if even its employees’ records can be compromised.

‘‘People should know about this because it’s crazy and scary,’’ she said.

In her statement, Kissko said the company takes the confidentiality of personal information very seriously.

Dreyfuss was offered a free tie and pocket handkerchief — a $61 value, but said she declined.

You have reached the limit of 10 free articles in a month

Stay informed with unlimited access to Boston’s trusted news source.

  • High-quality journalism from the region’s largest newsroom
  • Convenient access across all of your devices
  • Today’s Headlines daily newsletter
  • Subscriber-only access to exclusive offers, events, contests, eBooks, and more
  • Less than 25¢ a week