California’s unemployment benefits agency has sent out at least 38 million pieces of mail containing Social Security numbers since the start of the coronavirus pandemic, putting residents at risk of identity theft, according to a state audit released Thursday.

The Employment Development Department continued mailing forms without concealing sensitive information despite being told a year ago to stop the practice, California Auditor Elaine Howle said in a letter to Gov. Gavin Newsom.

“EDD’s failure to change its business practices in a timely manner has unnecessarily put claimants at increased risk of identity theft,” Howle wrote to the governor. “EDD must take swift action to end its potentially harmful practice and better safeguard the identities of the residents it serves.”

She urged the state’s jobless agency to immediately alter its three highest-volume mailers that include the Social Security numbers of people filing claims, instead of adhering to a previously announced timetable that would change the forms by August 2021.

Officials with the Employment Development Department and Gov. Gavin Newsom’s office didn’t immediately respond to requests for comment.

Concerns began growing in September about possible widespread fraud in the unemployment system following numerous reports of people receiving dozens of letters from the Employment Development Department that included the personal information of others. The agency is investigating previous evidence of fraud and recently said 350,000 benefit debit cards had been frozen as part of an ongoing effort to halt fraudulent claims.

Howle said Thursday that at least one claimant received more than 65 pieces of mail from the Employment Development Department addressed to at least 15 different people. Forms containing Social Security numbers could be used by scammers to obtain undeserved benefits, she said.

The surge in unemployment claims since spring, when the COVID-19 outbreak accelerated and more people lost work, “has further revealed the dangers of EDD’s practices,” Howle wrote. Since March the department has paid out $110 billion in unemployment benefits on 16.4 million claims.

Assemblyman Jim Patterson, a frequent critic of the Employment Development Department, said he was alarmed that officials had failed to act on recommendations made as far back as March 2019 to stop sending Social Security numbers out in mailed forms.

The latest audit reveals “the EDD is an accomplice in identity theft and fraud,” he said, calling on Newsom to “clean house” at the agency.

“EDD knows that scammers are on the lookout for this information. They have thumbed their nose at state law and have put the identities of 38 million Californians at risk,” said Patterson, a Republican from Fresno.

Howle said her office would undertake a broader audit of the Employment Development Department that would look at the “response to the COVID-19 pandemic, including its backlog of unemployment claims, its call center performance, and the adequacy of its information technology infrastructure.” That report is expected in early 2021.