72

I used to work for a company as head of one of the IT departments. I quit because of, let's say, overall low standards and my conviction that changing them would be very difficult or impossible given the existing conditions.

I've been out for a few weeks and I'm starting to work for the company's direct competitor on Monday.

At the same time I noticed that I still have reading access to the company's systems. Among other, I can see its financial results - data that I definitely shouldn't see anymore. Of course, I won't be checking this data, have no interest in them, but still.

Are there any reasons why I should let the company know? Are there any risks if I don't disclose that to them? (Everyone at the company knows the standards are bad and I don't feel like helping it unless there's a reason for me to do that. While working there I was criticized for reporting risks and even told explicitly I'm "too negative" for raising concerns).

Improve this question
10
  • 43
    "At the same time I noticed that I still have reading access to the company's systems." How did you notice it?
    – Aida Paul
    Commented Jan 1, 2021 at 11:00
  • 29
    @TymoteuszPaul, trying to access something different in my browser and clicking the link to the system instead (no login required). I then remembered we had this problem with other people while I was working there too.
    – user43902
    Commented Jan 1, 2021 at 11:22
  • 17
    Is it no login required or you were already logged in, as your cookie didn't expire?
    – Aida Paul
    Commented Jan 1, 2021 at 11:23
  • 9
    The question is: How are you getting in? Is the password stored in your browser? Do you still remember the password? If there is no password protection then absolutely anyone can access the account.
    – chasly - supports Monica
    Commented Jan 1, 2021 at 20:26
  • 7
    You should make clear in the question as to whether you are using personal credentials or an account created by the previous employer.
    – Keith
    Commented Jan 1, 2021 at 23:38

13 Answers 13

Reset to default
135

There's the sad principle that no good deed ever goes unpunished :-(

There are companies sadly that would lawyer up against you as soon as you say that you managed to access any data that you shouldn't have accessed. If you have the slightest inkling that your company is one of those, then you write them by registered mail to demand that they remove all your access to any of their servers, and you demand that they tell you in writing that all such access is gone.

Then make sure that you have evidence that you sent this letter. Evidence that they read it, or that they acted on it, is not necessary. Having sent the letter will protect you.

Improve this answer
17
  • 54
    Better yet, hire a lawyer to write and send that letter for you.
    – nick012000
    Commented Jan 1, 2021 at 21:21
  • 14
    This is the safer answer, compared to Joe Strazzere's. It's an unfortunate reality that, while rare, some companies will legally nuke someone for noticing a security flaw. This option covers OP's back. I would also recommend talking with a lawyer, as nick012000 mentions.
    – Drake P
    Commented Jan 2, 2021 at 3:22
  • 2
    @DavidZ The demand letter puts the onus on them if any legal action is later taken.
    – forest
    Commented Jan 2, 2021 at 3:50
  • 12
    DavidZ, what can they do? If I demand they close down any access to their servers that I might have, and their lawyers sends me a letter that they refuse, and a year letter someone breaks into their servers and they sue me, I pull out that letter from their lawyer refusing to protect their servers and they will be laughed out of court.
    – gnasher729
    Commented Jan 2, 2021 at 19:00
  • 5
    @nick012000 If the OP has to pay from their own pocket for a lawyer to fix a screw-up of their old employer, I'd rather tell them to leave the issue alone.
    – Dmitry Grigoryev
    Commented Jan 4, 2021 at 15:04
81

Are there any reasons why I should let the company know?

Because you are a good person and a professional.

And because if you were still with the company and another IT department head had left, you'd appreciate the same courtesy.

Improve this answer
14
  • 43
    And because you don't want to be accused if someone else accesses that data and abuses it.
    – gnasher729
    Commented Jan 1, 2021 at 17:19
  • 27
    @gnasher729 depends. In my country there are case of people sentenced after the reaction of the company was to sue the person for letting them know for computer breach.
    – user2284570
    Commented Jan 1, 2021 at 20:15
  • 23
    I agree that it would be "nice" and "professional", but at the same time find myself wondering whether any communication should be via a legal professional or similar "cut out" with OP's new employers' legal department made aware. If OP contacts them in person there's risk of a knee-jerk reaction, which they'd probably think twice about if a lawyer were in the circuit; and the last thing that's wanted is for companies in competition to start accusing each other of impropriety.
    – Mark Morgan Lloyd
    Commented Jan 1, 2021 at 20:33
  • 7
    @user2284570 citation needed, as the idea of someone being sentenced for literally an accident, with no data leaking, is very much unheard of as far as I know. The key is that it's as op says - one off accident, not intentional act.
    – Aida Paul
    Commented Jan 1, 2021 at 20:37
  • 11
    @TymoteuszPaul In my country (Hungary) a person discovered a serious vurnerabity in the electronic ticket system of the (state-owned) public transportation company, and reported it with details without exploiting it. The reaction: the company reported his acts to police, police sued for malicious access to data, person sentenced. Public outrage made the case eventually dropped at 2nd/3rd appeal, but such things happen if the leaders don't understand what "ethical" means in ethical hacker.
    – Neinstein
    Commented Jan 2, 2021 at 6:00
13

The simplest solution would be to send a friendly email to ask them if every procedure which needs to be done for you leaving the company has been carried out an if everything is alright or if they need you for any further action. If possible attach your own personal checklist and mark the things which you can legitimately know to be done as "done".

  • Account A
  • Access to System B
  • Keys to office: returned

After that, never use your login credentials again.

Improve this answer
7
  • 2
    Yes, there was a check list and I've done everything on it. The problem of insufficient security and no one deleting accesses of old employees is known in the company - I myself observed that when I was still part of the team.
    – user43902
    Commented Jan 1, 2021 at 18:00
  • Usually everything is resolved before or on the last day (as far as the leaving employee is concerned). While it probably wouldn't do much, if any, harm, I would still be quite baffled and suspicious if a former employee reaches out a few weeks after their last day to ask this. And certainly revoking access rights and deleting accounts takes some time sometimes and I guess something HR knows roughly nothing about (HR would be who to ask about leaving checklists; if you ask someone else who knows about revoking access, the request would come across as even more strange).
    – NotThatGuy
    Commented Jan 1, 2021 at 19:24
  • OP, are you folks an Windows or non Windows shop?
    – Anthony
    Commented Jan 1, 2021 at 20:40
  • @NotThatGuy which is why scripts for scheduled revocation of access is helpful :)
    – Anthony
    Commented Jan 1, 2021 at 20:41
  • 8
    @user43902 Their Problem is insufficient security. Your Problem is to document your willingness to participate in the revocation of your access.
    – Sascha
    Commented Jan 2, 2021 at 0:32
13

Mind your own business and CYA

Strictly speaking, if you accessed systems of your previous company, you have most likely broke the law. Situation is akin to selling someone a house with numerical lock code on doors. New owner may not change the combination, but that does not mean you have the right to enter your former home. You would have to consult legal expert about your legal liability, but I'm fairly certain that when you formally stopped working for your former employer, you lost legal right to use their non-public systems.

Now, if you formally or informally inform them about their security problems, you are implicitly admitting that you did something potentially illegal. They may or may not take this against you, but it is simply not worth of risk. Especially since you signed up with their direct competitor. Besides, it is no longer your concern. If you wanted to raise awareness about bad IT security practices, you should have done it while you were still employed. Now it is water under the bridge.

My advice to you is to delete any links, tokens, VPNs or applications that could be used for accessing systems of your former employer. Also, erase or try to forget any passwords. Of course, do not access any of their non-public systems ever again. And keep your mouth shut. In unlikely event of them discovering access from your computer (IP address) simply play dumb, say you had automatic logging enabled (or something like that) while you were still working for them but this was disabled (or deleted) long time ago. And then you could ask them innocently "You didn't disable my account when I left the company ?" But as I said, this is highly unlikely, if they eventually discover their security holes, they would most likely keep quiet about it.

Improve this answer
17
  • “Broken the law” - nowadays, many people use their private computer for work. So my email is set up to access my private email, and my company email. I expect my company to close my company email account, and I will remove it from my mail app when I have the time. And then I have to figure out how to remove it from my backups.
    – gnasher729
    Commented Jan 2, 2021 at 19:06
  • @gnasher729 Very thin ice there. You are certainly allowed to use your company mail while you work for them. After that, not so much. Remember, your backups - your responsibility. IMHO, it is always a good practice to have completely separate private and professional computers, if at all possible.
    – rs.29
    Commented Jan 2, 2021 at 19:42
  • 3
    @rs.29 - you're not understanding the issue of how poorly designed access mechanisms can lead to cached access tokens which still work after they no longer should. If those tokens are in the custody of an email client, a saved browser session, etc, those pieces of software can end up trying to use them without user intent or action. And regardless if they should, many companies do not issue devices for employees to use off-site, but expect instead that they use their own.
    – Chris Stratton
    Commented Jan 2, 2021 at 22:19
  • 1
    Breaking the law (at least sometimes) requires intent to be demonstrated. If you try the code to someone else's home, that's a pretty good demonstration of intent to commit a crime. If you accidentally click a link, and are authenticated via an automated process, intent is harder to prove. IANAL, though.
    – employee-X
    Commented Jan 4, 2021 at 5:14
  • 1
    @rs.29 You really think if someone logs in using the OP's credentials that anyone is going to say, "oh, it couldn't have been OP because we should have deleted that a long time ago"? And the OP doesn't just have to worry about (potential) criminal charges, if something happened there could easily be a law suit where the burden of proof is much different. (Disclaimer: I'm talking about the outlier situation where someone does access the system in a harmful manner, not the normal situation where nothing happens.)
    – user3067860
    Commented Jan 4, 2021 at 19:31
8

You are not a penetration tester and you have not been hired to test their systems.

As of the time you left, you are a stranger to them. Look at how other companies have dealt with uninvited security analyses of their systems. Sometimes it works out fine. Sometimes lawyers get involved. Although in an ideal world, you should tell them immediately, we live in a world where you could be viewed as an outsider (you are no longer employed there) who hacked them (exploited a security vulnerability) and stole their data (you received data intended only for employees).

Either stop accessing the data immediately and forget about the whole thing, or get a lawyer.

Improve this answer
3
  • 3
    The interesting problem is that if the system is poorly enough designed that old cookies still work, such malicious looking access could happen in ways which are completely automatic and unintended. URL auto-complete. Powering on a personal system not used in months and having the browser auto launch and bring up the pages last open, etc.
    – Chris Stratton
    Commented Jan 2, 2021 at 22:16
  • It's not at all clear that forgetting about the whole thing is the best idea. If they have even the most basic access logging they would be able to see that you accessed their system. If you don't tell them about it, they may or may not know or be able to conclusively prove that the person who accessed their system was actually you (although it certainly doesn't help that it was from your account and from your computer), but trying to hide the fact that you logged in would make them a lot more suspicious about your intentions and hurts your legal case a lot. Also, it sounds like legal advice.
    – NotThatGuy
    Commented Jan 3, 2021 at 9:40
  • @NotThatGuy I don't mean that they should pretend it didn't happen. When I say to forget about it, I mean stop engaging. And I don't really care if it's legal advice or not. Sue my proxy.
    – forest
    Commented Jan 3, 2021 at 9:44
7

Are there any reasons why I should let the company know?

Yes, you should let them know because you've done something that may or may not be illegal, more so you are now working to a direct competitor of that company which tends to make the situation problematic on few more levels.

Are there any risks if I don't signal that to them?

Certainly.

If the breach is ever detected then the problems may range from nothing, through PR issues and possible criminal investigation (though this would require some really antsy prosecutor, though again the fact that you are working for direct competitor makes it more likely). If you then try to give them this story from position of being found out, instead of coming clean it will likely make it less believable.

Ultimately if it was a geniune mistake then we should all act grown up and own them up, not hope to never be found out. That's integrity.

The unasked question:

How should I let them know?

Locate their person responsible for data security (In Europe that would usually be a Data Protection Officer for companies of non-micro size) and drop them an email outlining what you've accessed, when and what you've seen and that you've since purged the cookies/links from your devices. If you cannot locate that person, or don't feel like digging, then email everyone on the C-Suite instead.

And then proceed to do exactly that, go through your browser history and wipe out all those links from it + delete cookies related to your previous employer. As a tip for the future use a different profile (either browser or OS) for your work vs personal browsing, then you can simply delete that profile and all the company-related data is gone for good, protecting you from further accidents.

Improve this answer
14
  • 5
    @user43902 you've said: "trying to access something different in my browser and clicking the link to the system instead" so you did make a mistake of clicking the wrong link. And think of shooting out an email as covering your own ass, rather than doing them a favor. Or don't I am merely pointing out how this can be handled, what you do is ultimately up to you.
    – Aida Paul
    Commented Jan 1, 2021 at 11:44
  • 1
    @user43902 I don't understand your explanation. Either you should be able to see what you did, or you should not. If you should, that's fine. If you should not, you've discovered a hole in the security and you may even have compromised your current employer.
    – Andrew Leach
    Commented Jan 1, 2021 at 13:02
  • 3
    @Anthony Consider the possibility that OP might be accessing some sort of cloud computing service that is generally available, and is still getting access to financial data about their previous employer through it.
    – nick012000
    Commented Jan 1, 2021 at 21:20
  • 1
    @TymoteuszPaul That doesn't just happen. It's actually common. Talk to some pentesters about it.
    – forest
    Commented Jan 2, 2021 at 3:59
  • 3
    @Anthony Example: My workplace has GitHub repositories, and I use my own Git account to access and contribute to these. If I left the company, I would expect to continue to use my GitHub account but without access to the company's repositories. That access should be removed by the company when I leave.
    – ProgrammingLlama
    Commented Jan 2, 2021 at 5:36
5

So let me get this straight.

You and your coworkers knew about this security flaw when you were still working for them, but nothing was ever done about it.

Now you think that if you tell them now that you're gone and working for a competitor, that they will magically get their act together and fix this flaw. Your thinking doesn't make sense.

If I were you, I would just clear my browser of all cookies, delete any related bookmarks, and delete any credentials left on my own computer and any other device. That's it.

Do not expose your new employer to a potential lawsuit by contacting your old employer. And if you really need legal advice, ask the legal counsel of your new employer, but do not ask about this over email, talk to them in person or over the phone.

Improve this answer
2

"Are there any reasons why I should let the company know?"

Yes. Because you should have let them know before you left the job, if you saw it as an issue.

I don't intend to impugn your skills with the following scenario; management can be resistant and ignorant and it might not be your fault. But, there must have been other employees who quit. Were their privileges revoked as soon as they left? That should be a matter of policy.

Why would that not apply to you, and why wasn't it done?

Improve this answer
2
  • It seems like this is a recurrence or similar situation to a previously seen bug where removing someone's access from the system does not actually fully remove their access via saved tokens from past sessions, or similar. They probably removed the asker's ability to create a new session, but due to design errors old sessions are not invalidated.
    – Chris Stratton
    Commented Jan 2, 2021 at 22:21
  • 3
    Actually he did raise the issue while in the old job (in vain but your advice doesn't apply).
    – toolforger
    Commented Jan 3, 2021 at 11:56
2

Are there any reasons why I should let the company know?

It's ethical to tell. But it's also unethical for you to be snooping on your former employer. You could anonymously report some security flaws in a way that doesn't put the focus on you snooping where you shouldn't have.

Are there any risks if I don't signal that to them?

Sure. Somebody else could break into their system and do damage. Then when they investigate they find evidence that you broke into the system and blame you for the damage. I doubt you would find a judge tech savvy enough to agree with you that you didn't do anything harmful. Just a guess.

Improve this answer
4
  • 2
    It seems reasonable at this stage for the OP to confirm whether or not they still have access, however it's important for the OP to have that access revoked because in the event of a data breach they could show that they didn't have access to the data at the time of the breach. Just stopping accessing the data in question is not sufficient.
    – Frog
    Commented Jan 4, 2021 at 4:41
  • @Frog Right. And, raising the issue with them might be sufficient, even if access is not revoked quickly.
    – employee-X
    Commented Jan 4, 2021 at 5:15
  • Speaking for myself I’d be a lot happier if I had complete deniability
    – Frog
    Commented Jan 4, 2021 at 18:57
  • @Frog Good point.
    – HenryM
    Commented Jan 5, 2021 at 14:26
1

Following steps will make sure that you act ethically and at the same time will not give your ex company any opportunity to complain in case they are looking for one:

  • Understand that this situation is caused by your ex-company's less than stellar employee off-boarding protocols
  • Do NOT mention this to anyone officially or otherwise especially as you are working for a direct competitor - this won't bring anything good and at the same time could give them an impression that you are spying
  • Immediately, go through your list of bookmarks and stored passwords in your browser and delete all of those which access your previous companies systems
  • Remember that access logging based on IP or username is a trivial thing and if they figure out, they could potentially harm you legally
Improve this answer
1

Note: This answer is based on the relationship between an ex-employee and an ex-employer and is not legal advice, except inasmuch as directly stated. For legal advice, ask a lawyer.

You are not an employee of the company anymore. They are not paying you. You have no duty to help them with anything. They know you are not working for the company anymore, and therefore their security team should prioritize removing your passwords and access, and they probably already have and haven't had a chance to get around to it yet. And if they don't, it's not your problem.

What you should do is simply not access those accounts anymore. If you like, one thing you could do would be to change all your passwords to random jumbles of letters and numbers (literally just jam your fingers on the keyboard as randomly as you can) so the passwords can't be gained by phishing or other similar means, and to delete your cached cookies and whatnot. The danger here is that someone else gains access to your active account and logs in pretending to be you, and that gets logged and you get tagged, so any actions you take would be to protect yourself from that.

Another thing you could do would be to send them a quick email, something of the form "I noticed I can still access my accounts, please deactivate my access". The worst they could do would be to take legal action for you taking an investigation that you still have access, but you'd probably be protected under similar grounds to white hat hacking. Some other answers recommend hiring a lawyer to write an official letter and sending it by registered mail; while those things are definitely things to consider, they are also not free (and hiring a lawyer could be VERY expensive), and it's not your responsibility to spend a lot of money because your former employer is incompetent with respect to their own infosec. In all likelihood (I have second-hand anecdotal experience with this; this exact situation happened to a friend of mine), the company will never notice you still have the access, and as long as you don't use it they'll never notice any questionable logins, so the probability of you ever having any negative impact from this is pretty much zero, so I wouldn't bankrupt myself trying to CMA, it's not worth it.

Improve this answer
0

At the same time I noticed that I still have reading access to the company's systems. Among other, I can see its financial results - data that I definitely shouldn't see anymore. Of course, I won't be checking this data, have no interest in them, but still.

And yet, you're checking this data.

Stop. Immediately. Inform your previous company. End.

Improve this answer
0

I'm not a laywer, but here's my view of the legal situation you are in.

Accessing protected data without permission is a legal offense in most countries. This includes using a login data you'd expect not to work. It doesn't matter if you try a single password you know or guessed, or brute-force using an online password list.

Therefore, admitting you have accessed such data theoretically exposes you to legal action. It doesn't mean you will be found guilty: in fact, I would expect a reasonable judge to understand your motives (which are clearly to help your old employer, not to harm them) and dismiss the case, but you'd still have all the legal trouble. Moreover, your old employer will have nothing to gain from such actions: they can only demand compensation if they prove the damage you've done, which will be next to impossible since you didn't do anything with the data.

Sending a registered letter demanding to remove your access will not fully protect you. If they suspect you did access the data, they will easily find your login attempt in the logs, and sue you on those grounds, without mentioning your letter. And since the letter will be dated past your login attempt anyway, it will not offer you much protection in court either.

Not telling your old employer you accessed their data is arguably even worse, at it runs the risk that they will find it out on their own. In case of a lawsuit, it will be even harder for you to argue that your motives were benign if it looks like you tried to cover it up. Plus, if they get hacked by someone else and actual harm will be done, you will be on the hook for damages unless you can prove it wasn't you.

So, tell your employer you logged into your old account by mistake and ask them to disable it. You can do it via registered mail if you prefer, but don't expect it to offer much additional protection. I would only do this if they ignored my e-mail, an e-mail answer will be just as usable in court if it comes to this. Don't hire a lawyer until they sue, which they most likely won't as there's no reason for them to do so, as explained above.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .