Players rip MLL after data breach exposes private information

Past and present Major League Lacrosse players lashed out at the league’s Boston-based executives Tuesday, raising the possibility of legal action, after an accidental data breach potentially exposed the confidential personal information of more than 1,000 players.

Nearly five days passed between the time league officials discovered the breach last Wednesday and informed the affected players Monday. The incident involved the private information of nearly everyone who has played or registered to try out for an MLL team in the league’s 16-year history.

“The big decision I face today is whether or not to contact the state AG office regarding this ‘data incident,’ ’’ tweeted Jack Reid, a retired Boston Cannons defenseman. “My gut says yes.’’

MLL commissioner David Gross said in a statement that the league immediately removed the private information from its website upon discovering the problem.

“We take seriously the protection of our players’ personal information, and are providing all impacted players with access to prepaid credit monitoring,’’ Gross said. “We have reviewed our internal procedures and have made the changes to ensure that this oversight is never repeated. We sincerely apologize to the players and thank them for their cooperation.’’

The league declined further comment, although a staffer who was not authorized to speak publicly said he was unaware of any player’s identity having been stolen because of the problem.

Several players described the breach as symptomatic of deficiencies in the league’s management. Ryan Flanagan, a New York Lizards defenseman who serves on the MLL Players Council, asserted in a statement to the Globe and other publications that the league had ignored requests from the players to encrypt their personal information after previous but less serious lapses.

“This is unacceptable and inexcusable,’’ Flanagan said in the statement. “The players of Major League Lacrosse have continued to create an outstanding on-field product for fans and deserve better treatment off the field in a variety of areas, including the protection of our personal information.”

Flanagan and Reid later declined interview requests, citing their legal counsel’s advice.

MLL is owned in part by New Balance, which houses the league’s executive office at its Brighton headquarters. In an e-mail to the affected athletes on Monday, MLL officials said they discovered the breach last Thursday, a day after it occurred.

“We became aware that a link on our player pool registration inadvertently linked to an excel spreadsheet which contained your full name, address, telephone number, e-mail address, Social Security number, citizenship, date of birth, height, weight, position, college, graduation year, team, and non-MLL occupation,’’ the e-mail stated. “Upon discovery, we immediately disabled this link and began an investigation into the matter.’’

Flanagan criticized MLL officials for going “home for the weekend without making the players aware that their personal information was shared publicly.’’

MLL is composed of nine teams, including the Cannons, who play 14 regular-season games from April to August, with their home games at Harvard Stadium. Players earn an average of more than $10,000 a season and work additional jobs to make ends meet.

League officials strongly advised the affected athletes to establish free 90-day fraud alerts with credit reporting bureaus, consider placing credit freezes on their accounts, and, if their identity is stolen, file a complaint with the Federal Trade Commission.

Nonetheless, a number of current and former players were not pleased, as they demonstrated on Twitter.

“You couldn’t sell a comedy script written based on the blunders of @MLL_Lacrosse this season,’’ tweeted Jerry Ragonese, who plays for the New York Lizards. “A movie company would say it’s too unbelievable.’’

MLL continues to cope with growing pains as it tries to capture a greater share of the sports entertainment market. Lacking a major television contract, the league launched the Lax Sports Network, which streams games online, though some players and viewers have expressed disappointment at what they consider subpar productions.

With a change in leadership looming — Gross announced last year that he planned to step down after the 2017 season — the league’s current and former players are hoping for better days ahead. Some cited the data breach as evidence of the need for improvement.

Liam Banks, a retired MLL player and former executive for the league’s Atlanta Blaze, said, “This breach seems like another example of [league officials] cutting corners because they don’t have the right professionals in the front office to run this business like other sports such as Major League Baseball and the National Football League.’’