6

I was filling up some details in our payroll site that is maintained by a third party vendor. I had difficulty saving and there wasn't an error message. Curious, I decided to check the browser console to see if there were any logs, instead I found very sensitive data (like salary, SSN etc) of other employees easily available for anyone to view.

I informed this to my senior but I don't see any action being taken on this yet.

Should I report this to the payroll company directly or should it go through someone from our company?

  • I think this question is likely off-topic here b/c it's about what you should do re another vendor and not something that can be addressed within your actual workplace. If I were you, I'd just find the support contact address of the software vendor. Check if they have an address that's specifically for security reports, and be careful b/c not all vendors react positively towards such things. Consider a separate throw-away email address for this process. – code_dredd Oct 4 '17 at 5:21
  • Sometimes "the mills are slow" ... how long has it been since you reported? – Fildor Oct 4 '17 at 7:13
  • I assume this is a secure site? So not anyone could view it, just those authorised to access the site? – Kilisi Oct 4 '17 at 10:37
  • 1
    @Fildor yes, I agree. Just that most companies have a designated person/s doing payroll rather than random people logging in and poking around. So it's information that they can already access. I was just trying to get a clearer picture of the OP's situation. – Kilisi Oct 4 '17 at 11:30
  • 1
    @Kilisi Ah, I see. So your suspicion is, Hal could see that data because his user account has those permissions anyway? - Good point! – Fildor Oct 4 '17 at 11:40
9

You've not said what the outcome of the conversation with your superior was, and we don't know what's being discussed as a consequence of you reporting this.

Assuming nothing is happening:

Raise it through your own company's IT department. They're going to want to be aware of a security issue regarding exposure of confidential information inside their network.

Hopefully, demonstrating the security vulnerability will lead them to explore how to block this hole up.

Logging this as an IT ticket should helpfully ensure that something concrete happens about this report.

  • 1
    HR might be interested, too. If located in Germany, there is also a "Datenschutzbeauftragter" (data protection commissioner) who should be highly interested ... – Fildor Oct 4 '17 at 7:03
  • @Fildor Yes, this depends very much on the size of the company and what roles exist. You'd really hope that the questioner's superior would know the appropriate reporting line. – user44108 Oct 4 '17 at 7:07
  • It also might be happening something "behind the scenes". Obviously, as company lead I wouldn't want this to be known publicly at least until the issue is actually fixed. – Fildor Oct 4 '17 at 7:15
  • Kilisi brought up a good point that will also be addressed in an IT Ticket: It's invalid. If OP is already allowed to see the data, then other users may not see it even in the browser console. Which would lead to the ticket being marked as "invalid" (or similar). But at least, OP would have some feedback. – Fildor Oct 4 '17 at 11:43
  • 1
    Update: I informed this to the head IT department directly and she passed on information to the vendor. The vendor was quick to fix and push the updated code. Now I do not see any of the personal data. – Hal Oct 25 '17 at 8:57
0

EDIT: This answer presumes that you are in the payroll system correctly. That is, you aren't marked as an administrator and can't view this info through the UI. That is simply a case of reporting the error to payroll or HR.

If you're in the US, then the vendor seems to be in flagrant violation of privacy regulations. The vendor, in all likelihood, is subject to the FTC's Safeguards Rule, which governs the protection of private consumer's information. Chances are most modern nations have similar legislation governing the safeguarding of private information.

I'd check to see if the vendor hosts any anonymous hotlines that you can call to report the issue, and, failing that, a bug report form or something similar. Failing that, you can also do the same for your own company. If they don't have any hotlines to call, you can try the legal or security departments in your company.

While it's easy to be worried about repercussions (and the risks are real), your personal information is visible to other people as well, so you could likely sue the vendor right now under the aforementioned legislation. In that light, simply reporting the issue is a light touch.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.