Should I report a leak of confidential HR information?

Question

I found that an employee who is no longer with us uploaded a giant Excel file containing HR information into Slack. The file is available to anyone in our Slack and contains names of all current and former employees, their contact details, full names, who has stock options, annual leave entitlements, HR history and various notes about them, but not the compensation details. The file is somehow there and can be found in search, but is not attached to any message or posted into any channel (not sure how that works).

Should I tell our CTO about this? Nobody should really be able to find this information, and we even have some vendors, interns and part-times on our Slack who can probably find it.

On the other hand, I don't have a plausible explanation for how I found this file (yeah, I was poking around our Slack on a weekend to see what I can find). I also think that whatever I say in the future, people will hear it with the thought "oh, this guy had access to our employment records" at the back of their head.

In other words, I lose nothing if I don't report it, and I might lose something if I do. We don't seem to have a method to report things anonymously.

Also, we are a fairly small company (less than 200 people), so we don't have any official published policies regarding any of this.

Answer 1

I would report it.

Don't hide your identity, there is no point. If your company asks Slack, Slack can probably tell them who accessed that file. It's all in the logs anyway. It's just a matter of someone reading through them. Personally, I don't even understand your need for hiding your identity. You did nothing wrong.

In any case, better you be the one who accessed the file and who reported the breach than the one who accessed the file but who didn't report anything.

Answer 2

Depending on where your company is located, there are some privacy rules and laws which might mandate protecting personal data.

That apart, information like those you list might help a potential competitor in tailoring economical offers to lure employees in leaving the company.

I think you should report the leak, and if you are concerned about keeping your name out of this story, there are ways to do it (a dummy email account, a non signed paper mail, etc.).

Answer 3

You should immediately report this to whoever in your organization is responsible for data protection.

Unfortunately, you don't state what your jurisdiction is, so I will answer based on my jurisdiction.

In my jurisdiction, any company above a certain size must have a designated Data Protection Officer. (If more than 10 employees are routinely processing PII electronically.) This DPO must be able to report directly to the CEO, and their independence must be guaranteed. E.g. they can't be fired or reprimanded for informing the authorities about data breaches in the company.

You should immediately report this to your DPO. You can do this anonymously (again, the DPO is protected from any reprimand for not revealing their source).

Your company, in turn, is required by law to report this within 72 hours to their respective DPO, usually a government or law enforcement official of some sort, otherwise they risk hefty fines.

This is only about the PII data you talked about. Concerning the financial data that was leaked, there may be other laws and rules that are also violated.

Answer 4

I lose nothing if I don't report it, and I might lose something if I do

You may have something to lose if you don't report it…

…but later someone else does. If there's an audit following the report, your name may come up in a list of people who have downloaded the file. As a result, there may be questions as to what you did with the file when you downloaded it, and why you didn't report it.

Of course, it's not that serious unless there's proof that you have used data from that file, and if you only touched the file once, you can make up something like "I accidentally clicked on the wrong file and removed it without reading when I realised my mistake".

But why make up a lie when you can do something that's expected of you, that is, report it right away?

Answer 5

Personally, I would report it.

Think about it this way.

If it was YOUR data, what would you like to happen if somebody knew that YOUR data has been leaked.

Answer 6

I found that an employee who is no longer with us uploaded a giant Excel file containing HR information into Slack. The file is available to anyone in our Slack and contains names of all current and former employees, their contact details, full names, who has stock options, annual leave entitlements, HR history and various notes about them, but not the compensation details. The file is somehow there and can be found in search, but is not attached to any message or posted into any channel (not sure how that works).

Should I tell our CTO about this?

Yes, you should inform your CISO or CTO in writing.

In the verticals I have worked, stock options fall under executive compensation, and executive compensation is classified as high value data.

The high value classification includes mergers and acquisitions, pending litigation, executive compensation, company performance reports like unreleased SEC filings, etc.

Employee data is usually classified as medium or low value data. The data includes name address, phone number, social security number, etc.

And to add a twist, Slack may be encrypting the data such that only your company can decrypt it, so there may not be an external leak at all. (I don't know Slack and I have not performed a security evaluation on it, so I can't say what it is doing).

Companies care greatly if high value data is lost or leaked because of potential financial and reputational harm to the firm, especially in regulated environments like US Financial. In the US, companies don't cares as much if social security numbers or bank accounts numbers are leaked since there's little risk associated with losing it. Even healthcare data loss is a joke because HIPPA places artificially small limits on regulatory actions.

I don't know what happens in Asia, the EU or other countries and regions.

And keep in mind in the US risk is democratized by passing losses onto share holders, and reward is privatized through executive bonuses. Most data loss does not materially affect the company or executives. They pushed the risk onto shareholders, subscribers and consumers whose data is lost.

---

I don't have a plausible explanation for how I found this file (yeah, I was poking around our Slack on a weekend to see what I can find)

It does not really matter. You [hopefully] found it before a bad actor. I doubt anyone is going to blame you for it.

---

Also, we are a fairly small company (less than 200 people), so we don't have any official published policies regarding any of this.

Yes, that's fairly typical for small companies and firms.

It is a gap in your company's policies and procedures, and the executives need to address it. Until the executives decide to address it, the best you can do is report the incident to the CISO, CTO or other management.

---

If interested, in US Financial, I worked as a security architect in risk. I was responsible for evaluating internal systems and vendors systems (and vendor proposals).

We did three or four things:

1. Classify the data according to firm's policies and procedures
2. Perform a security evaluation on the system, ensuring the system could handle the data according to firm's policies and procedures
3. Provide suggested changes to ensure the data was handled according to firm's policies and procedures

Sometimes a vendor would refuse to bring a system in compliance with the firms policies and procedures. In this case, the executive sponsoring the initiative could say "I don't care, I want it anyway". If the executive said that, then the system and its security evaluation was sent to a Risk Committee to perform a detailed Cost/Benefit Analysis and determine if the firm should override my decision. The Risk Committee had final say on the matter.

The projects that gave me the hardest time were the "Board Pad" apps as I called them. Every executive wanted to go paperless and put company business on their iPads for board meetings. And of course, since they were executives, they wanted to carry around mergers and acquisitions, pending litigation, executive compensation, company performance reports. All protected with a 4 digit PIN code because the developer though Apple's authentication was adequate enough. Sigh...

Answer 7

Should I tell our CTO about this?

You should tell someone in management, whether that's the CTO, your direct manager, or someone else.

On the other hand, I don't have a plausible explanation for how I found this file (yeah, I was poking around our Slack on a weekend to see what I can find). I also think that whatever I say in the future, people will hear it with the thought "oh, this guy had access to our employment records" at the back of their head.

It really doesn't matter how you found it and I don't see any point in disclosing the fact that you found it while you were "poking" around. If this was in your company Slack then it wasn't sufficiently secured or monitored. If there are other things in your company Slack of this nature, and if you "stumbled" across them in Slack then the deficiency is in the implementation, not in your having found them. I'm not understanding why you think disclosing this would have negative repercussions for you.

In other words, I lose nothing if I don't report it, and I might lose something if I do. We don't seem to have a method to report things anonymously.

Again, I don't understand why you would be fearful of disclosing this. You've done nothing wrong. You discovered information that isn't supposed to be disclosed. That's not your fault. Unless you're not telling us the whole story. If it's the case that you actually "hacked" your company Slack (a secured channel meant for HR or something like that) then you should fear some repercussions.

Also, we are a fairly small company (less than 200 people), so we don't have any official published policies regarding any of this.

It doesn't matter how large or small your company is nor whether or not you have specific policies regarding this type of information. If this information falls under the purview of any privacy laws then this may be a breach of those laws.

Answer 8

Yes, and please do it anonymously.

In other words, I lose nothing if I don't report it, and I might lose something if I do.

You should definitely consider reporting to the concerned people (CTO, HR) and do so anonymously. On Slack, it is possible to delete a message. If this information gets to the right people, they may ask the poster to delete it. (Not sure if the Slack admin also has privilege to delete/mask messages).

We don't seem to have a method to report things anonymously.

In this day and age of dependency on digital devices and services, we totally forget the simplicity of older times. Simply write anonymous snail mails to the concerned people :) Don't write it by hand, type it and get it printed to mask any attempt of handwriting recognition. It even has the benefit that a digital message may get lost in the noise, but a snail mail is a sure shot way to grab one's attention since it's becoming increasingly rare to receive one.

Answer 9

Report it.

In light of this information, no one is gonna give a damn about you poking around in Slack; if the sysadmins have been doing their job then you poking around this wouldn't be a cause for concern as you should have been denied access to anything that wasnt in your domain so to speak.

If anything, it will look worse on you if you don't report it, as it raises the possibility that you may have been attempting to exploit the information for your own gain. At the very least it will raise questions as to why you were accessing this file without raising alarms. In other words you will no longer look like an innocent bystander.

Answer 10

Another point to consider, which I'll make with a story regarding a very similar situation I found myself in at a previous employer.

I was poking around our network looking for something (which had nothing to do with what I found) by searching at the command line with a regular expression. I don't even remember what I was looking for, but I found a file that somehow matched the regex which was a spreadsheet containing everyone in the company's pay rates, as well as their charge rate (what the company charged clients for our time) and other not-likely-to-be-divulged data.

This was very interesting data, but I felt guilty that I'd found and perused the file. The problem was, there simply weren't that many people in the company that could have found the file (by looking), but it wasn't like it was protected by ACLs or anything else, it was just out there on a shared network drive without any particular protection (not even read only, or password protected).

I agonized for a while over whether to tell my supervisor because I didn't want them to think I was snooping around, but in the end I told him about it. The look on his face when I showed him the file was impressive, clearly he had no idea such information was freely available to anyone with access to that share (everyone in the company). I felt better about telling him (although he would lay me off several months later along with bunch of other people, but I don't think they're related). I offered to help our IT department close the gap I'd found, but never heard back from them.

So, another month or two goes by, and I come to realize that the file I'd found wasn't unique in the slightest (I knew what it's file name was, so when I saw a similar file later, I recognized what it was). They included the exact same file in every job directory, there were literally thousands of copies of that same file. My agonizing had been a complete waste of time, not only were the files completely unprotected, they were everywhere, sometimes multiple copies in the same job directory.

The point is, that giant spreadsheet that was uploaded may have many-many-many siblings that aren't known to you, and it may not be worth your time to report it.

I'm not advocating that you ignore it, but consider that there may be more to the story than you know.

Answer 11

Thee are many great answers already telling you to report this improper data disclosure, and I agree wholeheartedly. You seem to be concerned about proper data security which is great, as everyone in a company has a role to play in the security of company assets. I am not sure of your role in the company or its culture, but if your management (i.e: CISO, CTO etc.), is interested in feedback, my answer to this question should be helpful.

Suggest your company document, approve, and communicate to all end users who will have access to company data, the policy of how to protect such data. To mitigate future scenarios such as the one you are in now, there should be methods on employees should be expected to report security incidents, and improper disclosure would certainly be an incident.

Also, it does not seem access is being properly monitored. I understand that your company is small, but access management will become more important as your company grows. An excellent practice to adopt would be least privileged access principle, so that employees / vendors / interns who have a need for access to do their jobs have access.

Answer 12

200 employees is large enough that I am pretty shocked that no policy exists. My last employer was a non-profit professional association of about 50 and I faced a similar situation. No policies, no best practices, nothing documented, zero consistency. Anyone who wanted to attack us probably could have done so with no resistance.

I took charge of it and began drafting up policies to share with my boss, who was the VP of IT. Technically I was hired to focus on managing the company website, but I ended up doing almost everything in the IT department. People were very shocked at how vulnerable our systems were and had never considered many of the risks. No one ever questioned why I knew so much about the topic, but my boss always wanted to hear answers. Our sysadmin deployed monitoring tools to our e-mail server to detect and block the transmission of PII and it saved us for at least one incident where an employee attempted to e-mail herself all pay data so she could process payroll while working at home.

This is an opportunity for you to take charge and be a leader, if you desire to do so. I understand your apprehension; I have been at companies that were driven by deflecting responsibility and blaming others, in spite of our "Agile" processes. I chose who I reported to very carefully and ended up going above my immediate supervisor because he really only cared about problems not coming back to him in any way and I would have to spend hours explaining things in detail so he could try to micromanage himself to safety. If you're in the kind of environment where you fear you might be punished for doing the right thing and improving the company, you are not in a healthy workplace and should consider leaving soon.

I would review your employee handbook for anything relevant, prepare a written statement, and discretely raise the issue with a supervisor who you trust.