INDIANAPOLIS -
The Indiana Attorney General's office is investigating after customers' private information was dumped outside a former south side gym.
Discovered in a dumpster, out in plain view were piles and piles of personal data, right in front of the former Cardinal Fitness on Southport Road.
For months, that data, including complete credit card numbers with expiration dates, sat ready and waiting for potential thieves.
Former gym member Paul Gaertner contacted Eyewitness News concerned.
"There's the full credit card number. That's ridiculous," Gaertner pointed out. "It's right here. It doesn't take a rocket scientist to find that one."
The receipts list names, addresses, and credit card numbers of former gym members, the same gym members left in the lurch when Cardinal suddenly closed last November.
"I stood out here for 45 minutes, rummaged through this. I was looking for my personal information because I was going to take it with me and destroy it. Unfortunately what they didn't do," Gaertner said. "It's just a no-brainer. Shred this stuff."
But it wasn't shredded.
In fact, the trash company says the dumpster has been there since December.
Neighbors noticed, but didn't realize the danger until now.
"Since this thing's been out here, it's shocking how many people have been through this dumpster," said Steve Asher, Southport Bar and Grill owner. "There have been people picking through it almost every day for awhile."
We wanted to know who's responsible - who left all of the documents in the dumpster and neglected to shred that personal information.
We called the building owners and tried to reach Cardinal, but received no response.
To keep people safe, we boxed up the sensitive information and took it to the Indiana Attorney General's office, which says this situation is likely a violation of state law.
Companies need to get rid of these documents the right way.
"It could be a violation of our state's security breach notification statute," explained Chuck Taylor, section chief of the Attorney General's Identity Theft Unit. "By law that means they should shred it, mutilate it, erase it, whatever they need to do to make it so it's no longer readable. This whole thing could have been avoided with a $25 shredder. It is part of doing business nowadays."
In Southport, that didn't happen, leaving people exposed to thieves.
"We're sitting here looking at a credit card number right now," Gaertner said. "What's to stop somebody who is actually dumpster diving who's got a 'habit' and he's looking for some money? Now these people are exposed and not protected."
The AG's Identity Theft Unit plans to go through all of the dumped data and contact the company responsible, which must in turn contact all clients whose information was compromised.
If you were a member of Cardinal Fitness, and you're concerned your data was comprised, call the Indiana Attorney General's Office or contact them online.
