Business owners say their personal data is being leaked on federal loan site

Small businesses across the U.S. have reported personal data leaks after applying for a disaster loan from the Small Business Administration. The SBA has yet to acknowledge the leaks, and its website was plagued by maintenance shutdowns in late March. The agency told CBS News it is currently operational — despite concerns from small business owners.

Eric Levinson opened The Hummingbird Inn, a pet-friendly Maryland bed-and-breakfast, in 2017. When the coronavirus pandemic hit and he was forced to close his doors, Levinson turned to the SBA for a disaster loan. 

“You go from a steady cash inflow, that you know, obviously ebbs and flows during the year, to it completely flatlining, no new reservations, no new booking, so no income at all,” he told CBS News’ Jim Axelrod. 

Levinson went online to the SBA site and found someone else’s date of birth, social security number, e-mail, phone numbers and business address all filled in on the loan registration page, where he was supposed to put his own personal information. 

Ten minutes after deleting the information and replacing it with his own, Levinson said he got a call from a business in Delaware that now had all of his data. 

“So, on top of the stress I have trying to keep this business going, now I don’t know who else could have seen that information,” he said. Nearly a dozen other small businesses told CBS News they experienced the same problem in late March.

Todd McCracken of the National Small Business Association said these leaks could not have come at a worse time.

“They’ve got to know not only that assistance is coming, but they can count on those sources,” he said. While he acknowledged that glitches like these can happen, he said it “undercuts” small business owners’ “confidence in the system,” and might lead them to make decisions that they otherwise would not have.

Despite the SBA’s claim the site is operational, Levinson said it was “not comforting” and that he was still apprehensive about filing his loan application.

“Haven’t been on the site since,” he said. “But I have, at this point … all of us have no choice.”

Levinson said he tried emailing and tweeting the agency, and even attended an online SBA webinar to alert them to the problem, but has not heard back.