Return to Answer

I found that an employee who is no longer with us uploaded a giant Excel file containing HR information into Slack. The file is available to anyone in our Slack and contains names of all current and former employees, their contact details, full names, who has stock options, annual leave entitlements, HR history and various notes about them, but not the compensation details. The file is somehow there and can be found in search, but is not attached to any message or posted into any channel (not sure how that works).

 

Should I tell our CTO about this?

I found that an employee who is no longer with us uploaded a giant Excel file containing HR information into Slack. The file is available to anyone in our Slack and contains names of all current and former employees, their contact details, full names, who has stock options, annual leave entitlements, HR history and various notes about them, but not the compensation details. The file is somehow there and can be found in search, but is not attached to any message or posted into any channel (not sure how that works).

Should I tell our CTO about this?

Companies care greatly if high value data is lost or leaked because of potential financial and reputational harm to the firm, especially in regulated environments like US Financial. In the US, companies don't cares as much if social security numbers or bank accounts numbers are leaked since there's little risk associated with losing it. I don't know what happens in Asia, the EU or other countries and regions.

And keep in mind in the US risk is democratized by passing losses onto share holders, and reward is privatized through executive bonuses, so most data loss does not materially affect executives.

Companies care greatly if high value data is lost or leaked because of potential financial and reputational harm to the firm, especially in regulated environments like US Financial. In the US, companies don't cares as much if social security numbers or bank accounts numbers are leaked since there's little risk associated with losing it. Even healthcare data loss is a joke because HIPPA places artificially small limits on regulatory actions.

I don't know what happens in Asia, the EU or other countries and regions.

And keep in mind in the US risk is democratized by passing losses onto share holders, and reward is privatized through executive bonuses. Most data loss does not materially affect the company or executives. They pushed the risk onto shareholders, subscribers and consumers whose data is lost.

Companies care greatly if high value data is lost or leaked because of potential financial and reputational harm to the firm, especially in regulated environments like US Financial. Companies don't cares as much if social security numbers or bank accounts numbers are leaked since there's little risk associated with losing it.

And keep in mind risk is democratized by passing losses onto share holders, and reward is privatized through executive bonuses, so most data loss does not materially affect executives.

Companies care greatly if high value data is lost or leaked because of potential financial and reputational harm to the firm, especially in regulated environments like US Financial. In the US, companies don't cares as much if social security numbers or bank accounts numbers are leaked since there's little risk associated with losing it. I don't know what happens in Asia, the EU or other countries and regions.

And keep in mind in the US risk is democratized by passing losses onto share holders, and reward is privatized through executive bonuses, so most data loss does not materially affect executives.