Company failed to take data breach seriously

Question

A few months back, I was working with someone in Payroll to resolve some paycheck errors that occurred when my employer switched to a new payroll system. As it turns out, hundreds of employees were impacted with paycheck errors. The payroll employee emailed me a spreadsheet with detailed payroll info for tons of these impacted employees, including names, employee ID numbers, paycheck amounts and dates, amount of overpayment/underpayment to the employee and if the discrepancy had been resolved or not.

I’m sure it was an error and the employee in Payroll intended to send me only my own pay documentation, but I highly doubt I’m the only one who received this file. I notified my leadership (who did nothing) and eventually HR (mentioned it while discussing another matter) and they made me delete the file I was emailed, but it doesn’t appear they have any intention of looking into it further or letting the employees know their paycheck info was sent out. With the info in the spreadsheet, one could easily enough reset passwords and access the 401k accounts of these employees. I'm comfortable filing a report with a federal or regulatory agency if need be, but I don’t even know exactly who to report it to, or if there are other, possibly better methods of handling this. The company is a total loss - they only make decisions that protect themselves, they won’t do the right thing themselves. Am I making too big a deal out of this?

Answer 1

You're right to be concerned, however unless you can prove that you were not the only person sent the file, you're merely making an assumption, without any evidence to back it up. Whether that assumption is correct or not is not a factor - you have to be able to prove it.

HR were right to tell you to delete it when you notified them. You did the right thing by notifying them, however your manager absolutely should have acted upon your notification and informed them of the breach. For them to not act is concerning in itself, but not the issue here.

You don't mention if you're still working there. If you are, think carefully about whistle-blowing. There may be laws to protect you depending on your location, or there may not be. Either way, you probably don't want to be working there if you do decide to blow the whistle and inform the regulators as that will place the company under very close scrutiny indeed, and questions will be asked as to who informed the regulators in the first place.

Answer 2

The company is a total loss - they only make decisions that protect themselves, they won’t do the right thing themselves. Am I making too big a deal out of this?

No you are not making a big deal. This is a very serious matter and it seems like your company has attempted to ignore the issue.

The first thing I would do is start looking for a new company to work for. Next you need to file a complaint with your state's attorney general regarding this incident. Under Iowa law at the very least the company should have notified the affected employees and from your post you indicate that they have done nothing.

Look for a new job and file a complaint with the attorney general.

Below is the relevant law:

Iowa Personal Information Security Breach Protection

Answer 3

tl;dr Be careful when asking law enforcement to handle an internal data breach.

This really stinks. That payroll person made a serious mistake. It could, as you say, lead to identity theft.

They handled it poorly. No doubt. You'd be wise to get another job.

But, the mistake is made. All secrets eventually leak. Not even state actors with unlimited resources (I'm looking at you, US NSA) can prevent secrets from leaking. A real question is how to clean up after leaks.

For the sake of argument, let's say an enlightened, smart, and compassionate manager drew the duty of dealing with this leak. Let's say you're that manager. What would you do about it?

• Call the cops? What action would you have them take? Remember: when the only tool you have is handcuffs, the whole world looks like pairs of hands to cuff.
• Make a big show of firing the clerk? What would that accomplish?
• Send out a mass email to everybody who received the secret data asking them to delete it? That might have worked. But it might also draw attention to the leaked data?
• Call a company meeting and have the executive team take responsibility and apologize? That might be a good path to follow. Your company didn't.
• Speak individually to people who received the leak? That IS what happened in your case.
• Renumber employees, rendering part of the leaked secrets useless? Might be a good idea.
• Request / force password changes on the employee 401K portal? That would be good.
• Start requiring mandatory information security training for everybody? Yes. That can pay off big time.

Before blowing the whistle on these guys, think hard about what you want law enforcement to do about the situation. Will they do what you want them to do?

If the leaked file contained ten thousand customer credit card numbers and the company did nothing about it, you would definitely blow the whistle, to a banking regulator. In that case you want them to require the company to notify those customers, etc.

Answer 4

It doesn’t appear they have any intention of looking into it further or letting the employees know their paycheck info was sent out

As someone who work in cybersecurity, I would not presume ill intent here. They may want to look into the improper disclosure, not necessarily breach of the payroll data, but not know how. From my work experience, its not appropriate to let employees know or suspect any particular employee unless there is evidence to support the transaction under that person's name. The search for such evidence usually involves interpretation of audit logs, a highly technical activity requiring hands - on training. Given the multitude of SIEM products, expecting non - technical senior leadership to perform this research is in my opinion unreasonable.

If there are other, possibly better methods of handling this.

Yes there are. If there is a dedicated department or role in your company responsible for IT Security or risk management, let these folks know as it their job to remediate security incidents. As O Jones mentioned, firing the employee or external reporting is unwise, because it not affect employee learning. It does not seem there is malice here, just ignorance on proper handling of personal data.

If your goal is to decrease the opportunity for a future incident, your internal employees are much better to handles this, as they know the processes / constraints / culture of your company better than an outside agency could.