The personal data of some small business owners seeking help via the Small Business Administration's Economic Injury Disaster Loan program may have been exposed to other applicants.
The SBA notified nearly 8,000 business owners of the potential inadvertent disclosure of information, which included names, Social Security numbers, tax identification numbers, addresses, dates of birth, email, phone numbers, marital and citizenship status, household size, income, disclosure inquiry and financial and insurance information, according to a letter sent to business owners, which CNBC obtained.
"Personal identifiable information of a limited number of Economic Injury Disaster Loan applicants was potentially exposed to other applicants on SBA's loan application site," a senior administration official told CNBC. "We immediately disabled the impacted portion of the website, addressed the issue, and relaunched the application portal."
The official said that, in order to access other business owners' information, small business applicants must have been in the loan application portal.
If the user attempted to hit the page back button, he or she may have seen information that belonged to another business owner, not their own. The official said that 4 million small business owners applied for $383 billion in aid via the EIDL program and emergency grants. The two programs are funded for just $17 billion.
The affected businesses have been offered identity theft protection services for a year. The letter sent to businesses said that, as of April 13, there has been no evidence to suggest there has been any attempt to misuse any of the information.
The disclosure is a potential hit to a program that has frustrated Main Street since its launch.
Small business owners are already frustrated
Small business owners were originally told they could access cash grants up to $10,000 through the program within three days of applying. That was changed to "within days" of applying, and caps were put on businesses to access only $1,000 per employee up to $10,000. The EIDL program runs through the SBA directly. It's separate from the Paycheck Protection Program, which hit its $350 billion lending ceiling with 1.6 million loans approved in less than two weeks.
As of April 20, the SBA reported that 26,919 disaster loans had been approved for a total of $5.6 billion, and 755,476 EIDL emergency grants had been processed for a total of $3.29 billion. Total disbursement numbers for the EIDL program and the PPP program have not been made available.
Data from the National Federation of Independent Business, or NFIB, show that three-quarters of small businesses have submitted applications for PPP funding as of April 17, the day after the program reached its funding ceiling. Just 20% had been fully processed with funds deposited in the borrower's account, while nearly 80% were still waiting, unsure where they were in the process, according to the NFIB.
Of the 40% who had successfully submitted an application for an EIDL through the SBA website, 77% requested the emergency grant of up to $10,000. Of those who had requested the emergency grant, about 10% received the funding. A quarter of small business owners believe it will be 2022 or later before the economy returns to normal, according to the NFIB survey.
A separate survey from the National Small Business Association found that just 5% of small business respondents that applied for an EIDL loan have received any money so far, while a quarter of businesses said they've received PPP funding. Two-thirds are now anticipating a recession in the next 12 months compared with just 14% in January, and nearly half of small businesses are not confident in the future of their business.