Should it be disclosed to a company that a number of their employees have been involved in a data breach, particularly one that has released special category or sensitive information; what is standard practise in responding, or passing this information along to their employees?

To be clear, in this example; employees often use their work email addresses to sign up for other websites for personal use (very bad practise, but surprisingly common). As such, any organisation monitoring OSINT (open source intelligence) feeds in order to be notified of emails being disclosed in a breach will become aware of which of their employees have been impacted.

This raises a number of questions, and I am hoping the community here may be able to provide answers from experience or practice.

  1. Is there any precedent or obligation, legal or otherwise (UK/EU), to inform the employees directly that they have been involved in a breach? Many organisations would seek to avoid the discussion altogether for fear of recrimination and a perceived waste of company resources assisting/investigating. What is the standard practise in such instances?
  2. In regards to 1; are there any circumstances or regions where it is legally mandated that the employee be informed by the employer? Should the breach be revealed to contain special category PII, sensitive or financial information that will likely bring harm or distress to the employee, does this change any answers?

Are there any defined lines that, when crossed, typically force a company to respond?

I'm not looking for moral or idealistic responses. I believe in a perfect world we would always disclose the information and everyone would go their own way to resolve without conflict. I am trying to understand how organisations actually respond, and what the common response to such incidents are.

  • 4
    Saying they're "involved in a breach" could mean that they perpetrated the breach or that they are "victims" of the breach. Which do you mean?
    – joeqwerty
    Aug 14 '19 at 22:14
  • 1
    For some things you have to use your work email to sign up, that’s the whole point of the commercial site licensing, for example Word & Excel ie Office 365...
    – Solar Mike
    Aug 15 '19 at 5:34
  • 1
    @joeqwerty, I would have thought from the pragmatic context this would have been obvious that they are 'victims'. If they were perpetrators, there would be very different considerations. Aug 15 '19 at 6:04
  • 1
    @SolarMike, yes. You're not actually 'signing up' to MS with work emails, typically, you're authenticating with them (the email IS the product in O365 for example)... but if MS was breached, this would likely be the end of Office products. Due to tenancy, that's largely impossible on a wide scale basis, though. Aug 15 '19 at 6:07
  • The simple answer is, you provide a company wide email with information about the attack and steps to mitigate any side effects. Then there will be an investigation into the cause and steps implemented to ensure it doesn't not happen again.
    – Shadowzee
    Aug 15 '19 at 7:14

UK is still covered by GDPR as of today. GDPR requires "data controllers" to notify affected organizations of breaches. Apparently that has happened.

If the breach involves personally identifiable information (PII), GDPR strongly encourages notification of the individual persons whose information leaked.

Where I work, we do our best to obey the spirit of GDPR everywhere in the world. If this happened here, we would almost certainly choose to notify the individuals involved. But our incident response team would consult with a privacy expert (lawyer, probably) to make that decision.

If you disclose, you won't have to explain to some regulator or auditor why you didn't disclose.


I think there is a far simpler and more pragmatic approach than to try to be sure you have exactly understood the fine details on constantly evolving legislation and judicial interpretation, where what was true when you made the policy could easily no longer be true at any future point because of some new decision (to say nothing of privately settled law suits, which you cannot expect to know about). In the EU alone, the GDPR contains 99 articles and 173 recitals - how confident are you that you've understood them all, and in the same way that judges and regulators in any applicable jurisdiction will agree with you?

Instead, just consider: if the employees were to find out later that you knew they were a victim of any kind of data breach, but you (or the company generally) decided not to notify them because the lawyers said you weren't strictly legally required to, how would you expect them to think about that? Do you want employees whose mindset is to do the absolute minimum they are legally required to do, with no further trust or goodwill beyond that? Would you behave differently if it were a manager or executive involved?

For companies that simply don't care about that, we can take this one step further: how are you certain that customer data or system integrity is not in any way imperiled, given that you know an employee using their work email address was involved with a breach? Are you sure they weren't using the same password/credentials they use at work? Are you sure no customer data was being used with the service? And how can you be sure of all of this if you haven't even contacted the employee to check, even to update their credentials to protect from future intrusion?

And let's be clear - most of the worlds businesses are behind the times and put their reputation and livelihoods in constant danger because they are stuck pretending that they can do the minimum and keep their heads down and things won't blow up on them. This is where the niceties of ethics prove to actually be more pragmatic and resilient than the alternatives. Human consideration of how to respond to people hiding important information from them has been around for thousands of years - adults still don't trust people that withhold important information from them. People aren't likely to suddenly decide it was OK, and no major countries laws have shown signs of prohibiting disclosure to one's own employees or clients.

Don't get stuck playing the game of "well, we knew we maybe should but we didn't think we were technically required to..." with anyone, it is a sucker bet. Lawyers love it (so many fees!), it annoys regulators, and much of the general public finds it just awful (and at best meets their expectations of how little they should expect of corporations). Knowing for sure if it was required would take a team of lawyers familiar with every jurisdiction you do business in, and could change any day - so take the easy way out and give people potentially critical information about security and privacy, regardless of whether you can figure out if you were technically required to do so.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .