The response by a Kansas state agency to a recent data breach is raising lots of questions—especially for the over 5.5 million individuals whose Social Security numbers were compromised.

Details on the number of Social Security numbers from residents in 10 states only came to light following a state freedom of information request by the Kansas News Service. Some 805,000 other user accounts which did not list their Social Security numbers were also compromised, according to the Kansas News Service, which includes KCUR news operations.

Mike Kautsch, a professor at University of Kansas School of Law, explained that the “Kansas Department of Commerce was overseeing the data system, so the agency bore responsibility for securing it. The data in the system related to an employment services network.”