Confetti that showered New Yorkers at the Macy's Thanksgiving Day Parade contained confidential police information, WPIX reports.
A university freshman discovered the security breach when a small piece of confetti got stuck on his friend's jacket.
"It says 'SSN' and it's written like a social security number, and we're like, 'That's really bizarre,'" Ethan Finkelstein said.
So they gathered up some more bits and pieced them together.
"There are phone numbers, addresses, more social security numbers, licence plate numbers and then we find all these incident reports from police."
The shredded documents were from the Nassau County Police Department. They contain the names, social security numbers, birth dates and other sensitive information about officers, some of them undercover cops.
"We will be conducting an investigation into this matter as well as reviewing our procedures for the disposing of sensitive documents," Insp. Kenneth Lack said in a statement.
Macy's said it uses "commercially manufactured, multi-colour confetti, not shredded paper."