Should I disclose that I can still access a company's systems after I've left?

Question

I used to work for a company as head of one of the IT departments. I quit because of, let's say, overall low standards and my conviction that changing them would be very difficult or impossible given the existing conditions.

I've been out for a few weeks and I'm starting to work for the company's direct competitor on Monday.

At the same time I noticed that I still have reading access to the company's systems. Among other, I can see its financial results - data that I definitely shouldn't see anymore. Of course, I won't be checking this data, have no interest in them, but still.

Are there any reasons why I should let the company know? Are there any risks if I don't disclose that to them? (Everyone at the company knows the standards are bad and I don't feel like helping it unless there's a reason for me to do that. While working there I was criticized for reporting risks and even told explicitly I'm "too negative" for raising concerns).

Answer 1

There's the sad principle that no good deed ever goes unpunished :-(

There are companies sadly that would lawyer up against you as soon as you say that you managed to access any data that you shouldn't have accessed. If you have the slightest inkling that your company is one of those, then you write them by registered mail to demand that they remove all your access to any of their servers, and you demand that they tell you in writing that all such access is gone.

Then make sure that you have evidence that you sent this letter. Evidence that they read it, or that they acted on it, is not necessary. Having sent the letter will protect you.

Answer 2

Are there any reasons why I should let the company know?

Because you are a good person and a professional.

And because if you were still with the company and another IT department head had left, you'd appreciate the same courtesy.

Answer 3

The simplest solution would be to send a friendly email to ask them if every procedure which needs to be done for you leaving the company has been carried out an if everything is alright or if they need you for any further action. If possible attach your own personal checklist and mark the things which you can legitimately know to be done as "done".

• Account A
• Access to System B
• Keys to office: returned

After that, never use your login credentials again.

Answer 4

Mind your own business and CYA

Strictly speaking, if you accessed systems of your previous company, you have most likely broke the law. Situation is akin to selling someone a house with numerical lock code on doors. New owner may not change the combination, but that does not mean you have the right to enter your former home. You would have to consult legal expert about your legal liability, but I'm fairly certain that when you formally stopped working for your former employer, you lost legal right to use their non-public systems.

Now, if you formally or informally inform them about their security problems, you are implicitly admitting that you did something potentially illegal. They may or may not take this against you, but it is simply not worth of risk. Especially since you signed up with their direct competitor. Besides, it is no longer your concern. If you wanted to raise awareness about bad IT security practices, you should have done it while you were still employed. Now it is water under the bridge.

My advice to you is to delete any links, tokens, VPNs or applications that could be used for accessing systems of your former employer. Also, erase or try to forget any passwords. Of course, do not access any of their non-public systems ever again. And keep your mouth shut. In unlikely event of them discovering access from your computer (IP address) simply play dumb, say you had automatic logging enabled (or something like that) while you were still working for them but this was disabled (or deleted) long time ago. And then you could ask them innocently "You didn't disable my account when I left the company ?" But as I said, this is highly unlikely, if they eventually discover their security holes, they would most likely keep quiet about it.

Answer 5

You are not a penetration tester and you have not been hired to test their systems.

As of the time you left, you are a stranger to them. Look at how other companies have dealt with uninvited security analyses of their systems. Sometimes it works out fine. Sometimes lawyers get involved. Although in an ideal world, you should tell them immediately, we live in a world where you could be viewed as an outsider (you are no longer employed there) who hacked them (exploited a security vulnerability) and stole their data (you received data intended only for employees).

Either stop accessing the data immediately and forget about the whole thing, or get a lawyer.

Answer 6

Are there any reasons why I should let the company know?

Yes, you should let them know because you've done something that may or may not be illegal, more so you are now working to a direct competitor of that company which tends to make the situation problematic on few more levels.

Are there any risks if I don't signal that to them?

Certainly.

If the breach is ever detected then the problems may range from nothing, through PR issues and possible criminal investigation (though this would require some really antsy prosecutor, though again the fact that you are working for direct competitor makes it more likely). If you then try to give them this story from position of being found out, instead of coming clean it will likely make it less believable.

Ultimately if it was a geniune mistake then we should all act grown up and own them up, not hope to never be found out. That's integrity.

The unasked question:

How should I let them know?

Locate their person responsible for data security (In Europe that would usually be a Data Protection Officer for companies of non-micro size) and drop them an email outlining what you've accessed, when and what you've seen and that you've since purged the cookies/links from your devices. If you cannot locate that person, or don't feel like digging, then email everyone on the C-Suite instead.

And then proceed to do exactly that, go through your browser history and wipe out all those links from it + delete cookies related to your previous employer. As a tip for the future use a different profile (either browser or OS) for your work vs personal browsing, then you can simply delete that profile and all the company-related data is gone for good, protecting you from further accidents.

Answer 7

So let me get this straight.

You and your coworkers knew about this security flaw when you were still working for them, but nothing was ever done about it.

Now you think that if you tell them now that you're gone and working for a competitor, that they will magically get their act together and fix this flaw. Your thinking doesn't make sense.

If I were you, I would just clear my browser of all cookies, delete any related bookmarks, and delete any credentials left on my own computer and any other device. That's it.

Do not expose your new employer to a potential lawsuit by contacting your old employer. And if you really need legal advice, ask the legal counsel of your new employer, but do not ask about this over email, talk to them in person or over the phone.

Answer 8

"Are there any reasons why I should let the company know?"

Yes. Because you should have let them know before you left the job, if you saw it as an issue.

I don't intend to impugn your skills with the following scenario; management can be resistant and ignorant and it might not be your fault. But, there must have been other employees who quit. Were their privileges revoked as soon as they left? That should be a matter of policy.

Why would that not apply to you, and why wasn't it done?

Answer 9

Are there any reasons why I should let the company know?

It's ethical to tell. But it's also unethical for you to be snooping on your former employer. You could anonymously report some security flaws in a way that doesn't put the focus on you snooping where you shouldn't have.

Are there any risks if I don't signal that to them?

Sure. Somebody else could break into their system and do damage. Then when they investigate they find evidence that you broke into the system and blame you for the damage. I doubt you would find a judge tech savvy enough to agree with you that you didn't do anything harmful. Just a guess.

Answer 10

Following steps will make sure that you act ethically and at the same time will not give your ex company any opportunity to complain in case they are looking for one:

• Understand that this situation is caused by your ex-company's less than stellar employee off-boarding protocols
• Do NOT mention this to anyone officially or otherwise especially as you are working for a direct competitor - this won't bring anything good and at the same time could give them an impression that you are spying
• Immediately, go through your list of bookmarks and stored passwords in your browser and delete all of those which access your previous companies systems
• Remember that access logging based on IP or username is a trivial thing and if they figure out, they could potentially harm you legally

Answer 11

Note: This answer is based on the relationship between an ex-employee and an ex-employer and is not legal advice, except inasmuch as directly stated. For legal advice, ask a lawyer.

You are not an employee of the company anymore. They are not paying you. You have no duty to help them with anything. They know you are not working for the company anymore, and therefore their security team should prioritize removing your passwords and access, and they probably already have and haven't had a chance to get around to it yet. And if they don't, it's not your problem.

What you should do is simply not access those accounts anymore. If you like, one thing you could do would be to change all your passwords to random jumbles of letters and numbers (literally just jam your fingers on the keyboard as randomly as you can) so the passwords can't be gained by phishing or other similar means, and to delete your cached cookies and whatnot. The danger here is that someone else gains access to your active account and logs in pretending to be you, and that gets logged and you get tagged, so any actions you take would be to protect yourself from that.

Another thing you could do would be to send them a quick email, something of the form "I noticed I can still access my accounts, please deactivate my access". The worst they could do would be to take legal action for you taking an investigation that you still have access, but you'd probably be protected under similar grounds to white hat hacking. Some other answers recommend hiring a lawyer to write an official letter and sending it by registered mail; while those things are definitely things to consider, they are also not free (and hiring a lawyer could be VERY expensive), and it's not your responsibility to spend a lot of money because your former employer is incompetent with respect to their own infosec. In all likelihood (I have second-hand anecdotal experience with this; this exact situation happened to a friend of mine), the company will never notice you still have the access, and as long as you don't use it they'll never notice any questionable logins, so the probability of you ever having any negative impact from this is pretty much zero, so I wouldn't bankrupt myself trying to CMA, it's not worth it.

Answer 12

At the same time I noticed that I still have reading access to the company's systems. Among other, I can see its financial results - data that I definitely shouldn't see anymore. Of course, I won't be checking this data, have no interest in them, but still.

And yet, you're checking this data.

Stop. Immediately. Inform your previous company. End.

Answer 13

I'm not a laywer, but here's my view of the legal situation you are in.

Accessing protected data without permission is a legal offense in most countries. This includes using a login data you'd expect not to work. It doesn't matter if you try a single password you know or guessed, or brute-force using an online password list.

Therefore, admitting you have accessed such data theoretically exposes you to legal action. It doesn't mean you will be found guilty: in fact, I would expect a reasonable judge to understand your motives (which are clearly to help your old employer, not to harm them) and dismiss the case, but you'd still have all the legal trouble. Moreover, your old employer will have nothing to gain from such actions: they can only demand compensation if they prove the damage you've done, which will be next to impossible since you didn't do anything with the data.

Sending a registered letter demanding to remove your access will not fully protect you. If they suspect you did access the data, they will easily find your login attempt in the logs, and sue you on those grounds, without mentioning your letter. And since the letter will be dated past your login attempt anyway, it will not offer you much protection in court either.

Not telling your old employer you accessed their data is arguably even worse, at it runs the risk that they will find it out on their own. In case of a lawsuit, it will be even harder for you to argue that your motives were benign if it looks like you tried to cover it up. Plus, if they get hacked by someone else and actual harm will be done, you will be on the hook for damages unless you can prove it wasn't you.

So, tell your employer you logged into your old account by mistake and ask them to disable it. You can do it via registered mail if you prefer, but don't expect it to offer much additional protection. I would only do this if they ignored my e-mail, an e-mail answer will be just as usable in court if it comes to this. Don't hire a lawyer until they sue, which they most likely won't as there's no reason for them to do so, as explained above.