The Comptroller's office says the records of three and a half million people were placed on the server with personally identifying information.