114

I found that an employee who is no longer with us uploaded a giant Excel file containing HR information into Slack. The file is available to anyone in our Slack and contains names of all current and former employees, their contact details, full names, who has stock options, annual leave entitlements, HR history and various notes about them, but not the compensation details. The file is somehow there and can be found in search, but is not attached to any message or posted into any channel (not sure how that works).

Should I tell our CTO about this? Nobody should really be able to find this information, and we even have some vendors, interns and part-times on our Slack who can probably find it.

On the other hand, I don't have a plausible explanation for how I found this file (yeah, I was poking around our Slack on a weekend to see what I can find). I also think that whatever I say in the future, people will hear it with the thought "oh, this guy had access to our employment records" at the back of their head.

In other words, I lose nothing if I don't report it, and I might lose something if I do. We don't seem to have a method to report things anonymously.

Also, we are a fairly small company (less than 200 people), so we don't have any official published policies regarding any of this.

  • 42
    Why do you think things will go wrong for you if your report it openly ? The fact that you found this file is not suspicious (it's a public file, you could easily say you were looking for some other information when you stumbled upon it). And why do you think everyone would know you reported it ? Does your company have a history of handling badly this sort of thing ? Personally, I would be very grateful to get this information as soon as possible. You're probably not the first one to see that information, but you would be the first to report it, and that would mean something to higher ups. – MlleMei Jun 23 at 9:54
  • 2
    What do you have to lose? You've used Slack the way it's intended to be used. As long as you haven't used stolen credentials or broken other people's passwords. – Agent_L Jun 23 at 13:47
  • 31
    There may be file access history to consider here. – PCARR Jun 23 at 14:32
  • 15
    Your location is important here, as if inside the EU then this would likely be a breach of GDPR. Can you confirm your (approximate) location - country, state or just something to give us basic indication? – AdzzzUK Jun 24 at 9:04
  • To coin a phrase, report the hell out of it. – AJFaraday Jun 26 at 10:39

12 Answers 12

233

I would report it.

Don't hide your identity, there is no point. If your company asks Slack, Slack can probably tell them who accessed that file. It's all in the logs anyway. It's just a matter of someone reading through them. Personally, I don't even understand your need for hiding your identity. You did nothing wrong.

In any case, better you be the one who accessed the file and who reported the breach than the one who accessed the file but who didn't report anything.

  • 97
    This. Plus, in some jurisdictions you have an obligation to report data breaches that you find, as soon as you find them, and if the OP appears in the logs as having viewed the file, but not having reported it, there may be negative inferences drawn. – Julia Hayward Jun 23 at 11:50
  • 4
    @jzenting then I suggest you read OP again. Although he doesn't seem to be aware of possible file access logging. – Based Jun 24 at 9:14
  • 15
    "Personally, I don't even understand your need for hiding your identity." - it seems to me the OP explained why he feels this need with "I don't have a plausible explanation for how I found this file" and "I also think that whatever I say in the future, people will hear...". If you think those are invalid concerns, then perhaps you could address them in the answer. – Jon Bentley Jun 24 at 11:01
  • 2
    Good explanation: You used any combined desktop/internet search tool, expecting it to find that file (or some information ALSO contained in that file which you ARE expected to use to do YOUR job) on your company intranet, instead finding it unexpectedly on the open internet... – rackandboneman Jun 24 at 15:36
  • 2
    FWIW a file that is "available to anyone" that "can be found in search" but "is not attached to any message or posted into any channel" sounds like an access control issue on Slack's end. – Denis de Bernardy Jun 24 at 18:07
21

Depending on where your company is located, there are some privacy rules and laws which might mandate protecting personal data.

That apart, information like those you list might help a potential competitor in tailoring economical offers to lure employees in leaving the company.

I think you should report the leak, and if you are concerned about keeping your name out of this story, there are ways to do it (a dummy email account, a non signed paper mail, etc.).

19

You should immediately report this to whoever in your organization is responsible for data protection.

Unfortunately, you don't state what your jurisdiction is, so I will answer based on my jurisdiction.

In my jurisdiction, any company above a certain size must have a designated Data Protection Officer. (If more than 10 employees are routinely processing PII electronically.) This DPO must be able to report directly to the CEO, and their independence must be guaranteed. E.g. they can't be fired or reprimanded for informing the authorities about data breaches in the company.

You should immediately report this to your DPO. You can do this anonymously (again, the DPO is protected from any reprimand for not revealing their source).

Your company, in turn, is required by law to report this within 72 hours to their respective DPO, usually a government or law enforcement official of some sort, otherwise they risk hefty fines.

This is only about the PII data you talked about. Concerning the financial data that was leaked, there may be other laws and rules that are also violated.

  • 5
    them using Slack in itself is already a serious red flag for data security, as Slack is an external party without any guarantees about data security of what you post there. That's a big reason the company I work for won't allow the use of Slack, having instead set up a similar system internally that's only accessible from the corporate network and hosted in our own datacenters. – jwenting Jun 24 at 4:19
  • 3
    @jwenting NASA uses Slack so go figure. I don't think they gain anything as a company if they can't provide a proper channel for professionals. – lucasgcb Jun 24 at 13:00
  • 3
    @lucasgcb Do they use it to transfer secure information, though? There's a difference between using Slack for casual communication and using it to transfer sensitive content. – JAB Jun 24 at 18:28
  • @lucasgcb NASA is a US agency. Our customers here in Europe are worried about data being stored on and transmitted through servers that are outside the EU because of differences in data protection and privacy protection laws regulating those servers. Hence the restriction on a lot of services. – jwenting Jun 25 at 3:34
  • 3
    @lucasgcb Just in the past few days it was reported that hackers breached a NASA JPL network and copied data related to Mars missions - the attack went undetected for a year. The NASA OIG blamed failures to segment the internal network into smaller segments, to keep the IT security database up to date and to resolve security vulnerabilities on a timely basis. In Dec 2018 it was reported that hackers obtained NASA employee and former employee PII in October 2018. NASA suffered similar hacks in 2011 and 2016 (in 2013 a hacker discovered that administrator credentials had been left on default). – Lag Jun 25 at 8:29
17

I lose nothing if I don't report it, and I might lose something if I do

You may have something to lose if you don't report it…

…but later someone else does. If there's an audit following the report, your name may come up in a list of people who have downloaded the file. As a result, there may be questions as to what you did with the file when you downloaded it, and why you didn't report it.

Of course, it's not that serious unless there's proof that you have used data from that file, and if you only touched the file once, you can make up something like "I accidentally clicked on the wrong file and removed it without reading when I realised my mistake".

But why make up a lie when you can do something that's expected of you, that is, report it right away?

16

Personally, I would report it.

Think about it this way.

If it was YOUR data, what would you like to happen if somebody knew that YOUR data has been leaked.

  • 2
    I'm not sure we can generalise and say that whenever there is something you would like someone else to do, you should do the same yourself in that situation. It's more important to consider things like whether it is correct, legal, possible, etc. to do that thing. For example, I would like my boss to double my salary. That doesn't mean that if the roles are reversed I should double my employee's salary. – Jon Bentley Jun 24 at 11:03
5

I found that an employee who is no longer with us uploaded a giant Excel file containing HR information into Slack. The file is available to anyone in our Slack and contains names of all current and former employees, their contact details, full names, who has stock options, annual leave entitlements, HR history and various notes about them, but not the compensation details. The file is somehow there and can be found in search, but is not attached to any message or posted into any channel (not sure how that works).

Should I tell our CTO about this?

Yes, you should inform your CISO or CTO in writing.

In the verticals I have worked, stock options fall under executive compensation, and executive compensation is classified as high value data.

The high value classification includes mergers and acquisitions, pending litigation, executive compensation, company performance reports like unreleased SEC filings, etc.

Employee data is usually classified as medium or low value data. The data includes name address, phone number, social security number, etc.

And to add a twist, Slack may be encrypting the data such that only your company can decrypt it, so there may not be an external leak at all. (I don't know Slack and I have not performed a security evaluation on it, so I can't say what it is doing).

Companies care greatly if high value data is lost or leaked because of potential financial and reputational harm to the firm, especially in regulated environments like US Financial. In the US, companies don't cares as much if social security numbers or bank accounts numbers are leaked since there's little risk associated with losing it. Even healthcare data loss is a joke because HIPPA places artificially small limits on regulatory actions.

I don't know what happens in Asia, the EU or other countries and regions.

And keep in mind in the US risk is democratized by passing losses onto share holders, and reward is privatized through executive bonuses. Most data loss does not materially affect the company or executives. They pushed the risk onto shareholders, subscribers and consumers whose data is lost.


I don't have a plausible explanation for how I found this file (yeah, I was poking around our Slack on a weekend to see what I can find)

It does not really matter. You [hopefully] found it before a bad actor. I doubt anyone is going to blame you for it.


Also, we are a fairly small company (less than 200 people), so we don't have any official published policies regarding any of this.

Yes, that's fairly typical for small companies and firms.

It is a gap in your company's policies and procedures, and the executives need to address it. Until the executives decide to address it, the best you can do is report the incident to the CISO, CTO or other management.


If interested, in US Financial, I worked as a security architect in risk. I was responsible for evaluating internal systems and vendors systems (and vendor proposals).

We did three or four things:

  1. Classify the data according to firm's policies and procedures
  2. Perform a security evaluation on the system, ensuring the system could handle the data according to firm's policies and procedures
  3. Provide suggested changes to ensure the data was handled according to firm's policies and procedures

Sometimes a vendor would refuse to bring a system in compliance with the firms policies and procedures. In this case, the executive sponsoring the initiative could say "I don't care, I want it anyway". If the executive said that, then the system and its security evaluation was sent to a Risk Committee to perform a detailed Cost/Benefit Analysis and determine if the firm should override my decision. The Risk Committee had final say on the matter.

The projects that gave me the hardest time were the "Board Pad" apps as I called them. Every executive wanted to go paperless and put company business on their iPads for board meetings. And of course, since they were executives, they wanted to carry around mergers and acquisitions, pending litigation, executive compensation, company performance reports. All protected with a 4 digit PIN code because the developer though Apple's authentication was adequate enough. Sigh...

  • 3
    From a fellow security engineer, great answer overall. However I disagree with this statement "if social security numbers or bank accounts numbers are leaked since there's little risk associated with losing it.". Bank accounts numbers and SSN are considered PII information and I believe the GLBA banking law protects these as sensitive customer data. There are quite hefty fines if these are improperly protected. – Anthony Jun 24 at 3:25
  • If you can clarify, I will upvote this. Also what has your experience been when internal business management refuses to remediate non - compliance? Pretty common situation that I faced... – Anthony Jun 24 at 3:28
  • Executive compensation high value, employees home addresses low value. Says it all really. – Gaius Jun 25 at 13:57
  • I am not sure I follow your response. I am in the USA. Why did you think I was in Europe? Btw, GLBA is the Gramm - Leach Billey Act – Anthony Jun 26 at 1:09
  • @Anthony - Sorry about that. I crossed my wires and thought you were talking about the EU initiative. GLBA is a joke. It is a license to give your information away, just like HIPPA. About all it provides is disclosure requirements. And as far as I know, there is no oversight agency. Checkout Subtitle A--Disclosure of Nonpublic Personal Information, Sec. 501 - 510. (It is mostly what one would expect from legislation written by lobbyists). – user25792 Jun 26 at 2:12
4

Should I tell our CTO about this?

You should tell someone in management, whether that's the CTO, your direct manager, or someone else.

On the other hand, I don't have a plausible explanation for how I found this file (yeah, I was poking around our Slack on a weekend to see what I can find). I also think that whatever I say in the future, people will hear it with the thought "oh, this guy had access to our employment records" at the back of their head.

It really doesn't matter how you found it and I don't see any point in disclosing the fact that you found it while you were "poking" around. If this was in your company Slack then it wasn't sufficiently secured or monitored. If there are other things in your company Slack of this nature, and if you "stumbled" across them in Slack then the deficiency is in the implementation, not in your having found them. I'm not understanding why you think disclosing this would have negative repercussions for you.

In other words, I lose nothing if I don't report it, and I might lose something if I do. We don't seem to have a method to report things anonymously.

Again, I don't understand why you would be fearful of disclosing this. You've done nothing wrong. You discovered information that isn't supposed to be disclosed. That's not your fault. Unless you're not telling us the whole story. If it's the case that you actually "hacked" your company Slack (a secured channel meant for HR or something like that) then you should fear some repercussions.

Also, we are a fairly small company (less than 200 people), so we don't have any official published policies regarding any of this.

It doesn't matter how large or small your company is nor whether or not you have specific policies regarding this type of information. If this information falls under the purview of any privacy laws then this may be a breach of those laws.

4

Yes, and please do it anonymously.

In other words, I lose nothing if I don't report it, and I might lose something if I do.

You should definitely consider reporting to the concerned people (CTO, HR) and do so anonymously. On Slack, it is possible to delete a message. If this information gets to the right people, they may ask the poster to delete it. (Not sure if the Slack admin also has privilege to delete/mask messages).

We don't seem to have a method to report things anonymously.

In this day and age of dependency on digital devices and services, we totally forget the simplicity of older times. Simply write anonymous snail mails to the concerned people :) Don't write it by hand, type it and get it printed to mask any attempt of handwriting recognition. It even has the benefit that a digital message may get lost in the noise, but a snail mail is a sure shot way to grab one's attention since it's becoming increasingly rare to receive one.

  • 9
    Why do they have to report this anonymously, OP has done nothing wrong. As long as they report it, then never talk about the content to anyone, there should be no negative repercussions. I'm really quite curious, since you go as far as to recommend snail mail and printing a letter. BTW OP, it would be easier to use a temporary e-mail address (like yopmail) if you truly wish to report this anonymously. – MlleMei Jun 23 at 9:48
  • 7
    My question still stands, you're encouraging OP to report it anonymously and I wonder why. I see nothing wrong in the situation itself that warrants this (I wouldn't think twice telling my manager people have access to confidential information). Maybe the company has handled such things badly in the past, or OP is too much of a worrier and is making a mountain out of a molehill. My question is, what in the situation makes you think OP is right to take such precautions. – MlleMei Jun 23 at 10:04
  • 3
    @NimeshNeema he is taking a chance that if he reports it anonymously, file access log will be requested and it will be seen that he had viewed the file. Without the benefit of having reported it. – Gnudiff Jun 23 at 13:21
  • 5
    Printed letters are not anonymous! See en.wikipedia.org/wiki/Machine_Identification_Code – Navin Jun 23 at 17:24
  • 5
    @Neuromancer A good (or even average) company wouldn't just tell willy nilly who reported this kind of information. Unless the company has handled issues like those badly in the past, I wouldn't worry about it. It is more likely his manager and higher ups will remember OP's reporting positively, it will bring him more good than bad. And like others already said, OP might get in legal trouble if it is known he accessed the file and didn't report it. – MlleMei Jun 23 at 20:49
4

Report it.

In light of this information, no one is gonna give a damn about you poking around in Slack; if the sysadmins have been doing their job then you poking around this wouldn't be a cause for concern as you should have been denied access to anything that wasnt in your domain so to speak.

If anything, it will look worse on you if you don't report it, as it raises the possibility that you may have been attempting to exploit the information for your own gain. At the very least it will raise questions as to why you were accessing this file without raising alarms. In other words you will no longer look like an innocent bystander.

  • without an explanation, this answer may become useless in case if someone else posts an opposite opinion. For example, if someone posts a claim like "Don't report it. In light of this information, everyone is gonna damn you about poking around in Slack. If anything, it will look worse on you if you do", how would this answer help reader to pick of two opposing opinions? Consider editing it into a better shape, to meet How to Answer guidelines – gnat Jun 24 at 10:38
  • The OP of this answer already explained that "it will look worse on you if you don't". – scaaahu Jun 24 at 11:01
  • 1
    @gnat added 'whys' to my statements – 520 Jun 24 at 12:43
1

Another point to consider, which I'll make with a story regarding a very similar situation I found myself in at a previous employer.

I was poking around our network looking for something (which had nothing to do with what I found) by searching at the command line with a regular expression. I don't even remember what I was looking for, but I found a file that somehow matched the regex which was a spreadsheet containing everyone in the company's pay rates, as well as their charge rate (what the company charged clients for our time) and other not-likely-to-be-divulged data.

This was very interesting data, but I felt guilty that I'd found and perused the file. The problem was, there simply weren't that many people in the company that could have found the file (by looking), but it wasn't like it was protected by ACLs or anything else, it was just out there on a shared network drive without any particular protection (not even read only, or password protected).

I agonized for a while over whether to tell my supervisor because I didn't want them to think I was snooping around, but in the end I told him about it. The look on his face when I showed him the file was impressive, clearly he had no idea such information was freely available to anyone with access to that share (everyone in the company). I felt better about telling him (although he would lay me off several months later along with bunch of other people, but I don't think they're related). I offered to help our IT department close the gap I'd found, but never heard back from them.

So, another month or two goes by, and I come to realize that the file I'd found wasn't unique in the slightest (I knew what it's file name was, so when I saw a similar file later, I recognized what it was). They included the exact same file in every job directory, there were literally thousands of copies of that same file. My agonizing had been a complete waste of time, not only were the files completely unprotected, they were everywhere, sometimes multiple copies in the same job directory.

The point is, that giant spreadsheet that was uploaded may have many-many-many siblings that aren't known to you, and it may not be worth your time to report it.

I'm not advocating that you ignore it, but consider that there may be more to the story than you know.

  • 3
    I would have told my supervisor that second time. If it was that important to him, he would have followed up on it that second time. Not only that, but you can usually tell who copied the file there, so that would have told your supervisor who needed training on security issues (or which department needed training on security issues). – Stephan Branczyk Jun 23 at 21:32
  • Actually, I think I did, but I'm not certain. This was over a decade ago and my memory is fuzzy on the aftermath. I just remember being astounded (again), that the file existed everywhere. – delliottg Jun 26 at 14:59
1

Thee are many great answers already telling you to report this improper data disclosure, and I agree wholeheartedly. You seem to be concerned about proper data security which is great, as everyone in a company has a role to play in the security of company assets. I am not sure of your role in the company or its culture, but if your management (i.e: CISO, CTO etc.), is interested in feedback, my answer to this question should be helpful.

Suggest your company document, approve, and communicate to all end users who will have access to company data, the policy of how to protect such data. To mitigate future scenarios such as the one you are in now, there should be methods on employees should be expected to report security incidents, and improper disclosure would certainly be an incident.

Also, it does not seem access is being properly monitored. I understand that your company is small, but access management will become more important as your company grows. An excellent practice to adopt would be least privileged access principle, so that employees / vendors / interns who have a need for access to do their jobs have access.

  • 1
    Our security policy mandates that employees have to report such incidents if they become aware of it. It’s part of the work manual and should be everywhere. – eckes Jun 25 at 8:19
0

200 employees is large enough that I am pretty shocked that no policy exists. My last employer was a non-profit professional association of about 50 and I faced a similar situation. No policies, no best practices, nothing documented, zero consistency. Anyone who wanted to attack us probably could have done so with no resistance.

I took charge of it and began drafting up policies to share with my boss, who was the VP of IT. Technically I was hired to focus on managing the company website, but I ended up doing almost everything in the IT department. People were very shocked at how vulnerable our systems were and had never considered many of the risks. No one ever questioned why I knew so much about the topic, but my boss always wanted to hear answers. Our sysadmin deployed monitoring tools to our e-mail server to detect and block the transmission of PII and it saved us for at least one incident where an employee attempted to e-mail herself all pay data so she could process payroll while working at home.

This is an opportunity for you to take charge and be a leader, if you desire to do so. I understand your apprehension; I have been at companies that were driven by deflecting responsibility and blaming others, in spite of our "Agile" processes. I chose who I reported to very carefully and ended up going above my immediate supervisor because he really only cared about problems not coming back to him in any way and I would have to spend hours explaining things in detail so he could try to micromanage himself to safety. If you're in the kind of environment where you fear you might be punished for doing the right thing and improving the company, you are not in a healthy workplace and should consider leaving soon.

I would review your employee handbook for anything relevant, prepare a written statement, and discretely raise the issue with a supervisor who you trust.

protected by mcknz Jun 25 at 21:04

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.