6

I was filling up some details in our payroll site that is maintained by a third party vendor. I had difficulty saving and there wasn't an error message. Curious, I decided to check the browser console to see if there were any logs, instead I found very sensitive data (like salary, SSN etc) of other employees easily available for anyone to view.

I informed this to my senior but I don't see any action being taken on this yet.

Should I report this to the payroll company directly or should it go through someone from our company?

Improve this question
7
  • I think this question is likely off-topic here b/c it's about what you should do re another vendor and not something that can be addressed within your actual workplace. If I were you, I'd just find the support contact address of the software vendor. Check if they have an address that's specifically for security reports, and be careful b/c not all vendors react positively towards such things. Consider a separate throw-away email address for this process.
    – code_dredd
    Oct 4, 2017 at 5:21
  • Sometimes "the mills are slow" ... how long has it been since you reported?
    – Fildor
    Oct 4, 2017 at 7:13
  • I assume this is a secure site? So not anyone could view it, just those authorised to access the site?
    – Kilisi ♦
    Oct 4, 2017 at 10:37
  • 1
    @Fildor yes, I agree. Just that most companies have a designated person/s doing payroll rather than random people logging in and poking around. So it's information that they can already access. I was just trying to get a clearer picture of the OP's situation.
    – Kilisi ♦
    Oct 4, 2017 at 11:30
  • 1
    @Kilisi Ah, I see. So your suspicion is, Hal could see that data because his user account has those permissions anyway? - Good point!
    – Fildor
    Oct 4, 2017 at 11:40

2 Answers 2

Reset to default
9

You've not said what the outcome of the conversation with your superior was, and we don't know what's being discussed as a consequence of you reporting this.

Assuming nothing is happening:

Raise it through your own company's IT department. They're going to want to be aware of a security issue regarding exposure of confidential information inside their network.

Hopefully, demonstrating the security vulnerability will lead them to explore how to block this hole up.

Logging this as an IT ticket should helpfully ensure that something concrete happens about this report.

Improve this answer
5
  • 1
    HR might be interested, too. If located in Germany, there is also a "Datenschutzbeauftragter" (data protection commissioner) who should be highly interested ...
    – Fildor
    Oct 4, 2017 at 7:03
  • @Fildor Yes, this depends very much on the size of the company and what roles exist. You'd really hope that the questioner's superior would know the appropriate reporting line.
    – user44108
    Oct 4, 2017 at 7:07
  • It also might be happening something "behind the scenes". Obviously, as company lead I wouldn't want this to be known publicly at least until the issue is actually fixed.
    – Fildor
    Oct 4, 2017 at 7:15
  • Kilisi brought up a good point that will also be addressed in an IT Ticket: It's invalid. If OP is already allowed to see the data, then other users may not see it even in the browser console. Which would lead to the ticket being marked as "invalid" (or similar). But at least, OP would have some feedback.
    – Fildor
    Oct 4, 2017 at 11:43
  • 1
    Update: I informed this to the head IT department directly and she passed on information to the vendor. The vendor was quick to fix and push the updated code. Now I do not see any of the personal data.
    – Hal
    Oct 25, 2017 at 8:57
0

EDIT: This answer presumes that you are in the payroll system correctly. That is, you aren't marked as an administrator and can't view this info through the UI. That is simply a case of reporting the error to payroll or HR.

If you're in the US, then the vendor seems to be in flagrant violation of privacy regulations. The vendor, in all likelihood, is subject to the FTC's Safeguards Rule, which governs the protection of private consumer's information. Chances are most modern nations have similar legislation governing the safeguarding of private information.

I'd check to see if the vendor hosts any anonymous hotlines that you can call to report the issue, and, failing that, a bug report form or something similar. Failing that, you can also do the same for your own company. If they don't have any hotlines to call, you can try the legal or security departments in your company.

While it's easy to be worried about repercussions (and the risks are real), your personal information is visible to other people as well, so you could likely sue the vendor right now under the aforementioned legislation. In that light, simply reporting the issue is a light touch.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .