44

My ex manager who left our company recently called me up a couple of days back, and asked me to share a document. This is somewhat a confidential doc, as it relates to sales.

He could have easily copied it himself before he quit, but he is asking me to do it now. He says he wants this document just for reference.

I find it a bit fishy, and I'm worried if this might affect our business. Am I just overreacting?

Improve this question
6
  • 63
    Documents relating to sales aren't just "somewhat confidential". Most companies consider them very confidential.
    – ObscureOwl
    Dec 16 '19 at 15:56
  • 22
    That ex-manager is asking you to commit a crime. Do not do it. Do not even reply. Report him immediately.
    – Stephan Branczyk
    Dec 17 '19 at 9:13
  • 1
    @Flater this feels like the basic premise of the purge when you put it like that lol
    – Patrice
    Dec 17 '19 at 13:07
  • 1
    As other stated, do not send such documents, but are you even sure that this is your ex-manager and not someone posing as him. I would not send such documents too an private email adres even if the person was still working at the company, let alone ex-employees. Most information gets leaked by simple tricks like impersonation and not by some fancy complicated hacking!
    – Jeroen
    Dec 17 '19 at 13:57
  • 1
    @StephanBranczyk Not only is he asking you to commit a crime, but he's asking you to do a crime he was not willing to do himself and let you take the fall for it.
    – Carduus
    Dec 17 '19 at 14:15
110

NO

This is a bad idea which could get you in trouble.

The way to handle it is to go back and say something along the lines of sending an email to your current manager, copying in anyone appropriate asking for approval to share the document.

Update from comments:

I want to make it clear that there should be no doubt in your mind that sending the document is a bad idea. Ensure your boss knows that you know that and that you never would without express permission. You can even mention you are concerned it is a phishing attempt. If you want to keep yourself out of it, you can just forward the email onto your boss.

It may be completely innocent and all above board, or it may be dodgy but you'll want written permission by someone with the authority to give it. Treat all company documents as company property (because they are) this isn't really your decision to make.

If your ex-manager chases in the mean time you can just say: "I'm just waiting on approval for your request". If he kicks off, you know something fishy is going on.

Improve this answer
7
  • 23
    I wouldn't even ask for approval (might imply that you think it's something that should be disclosed). I would just inform them of the request and let them decide what to do about it.
    – Kaz
    Dec 16 '19 at 16:21
  • 1
    @Kas another good option. I think by asking, you're already letting them know it's something your unsure of in a non-confrontational manner
    – Gamora
    Dec 16 '19 at 16:37
  • 27
    Bee You don’t want anyone at your company think that you were unsure about this even for one second. Nobody would trust you anymore.
    – gnasher729
    Dec 16 '19 at 17:16
  • 3
    I have amended my answer to include that OP is aware that they would not without express permision
    – Gamora
    Dec 16 '19 at 17:49
  • 3
    I would definitely at least alert your boss regarding a possible phishing attempt.
    – Rich
    Dec 17 '19 at 13:51
23

No, you should not share your company documents with people who are not working for your company and/or don't have written permission to access them.

Improve this answer
0
20

so my ex manager who left our company recently called me up a couple of days back to share a document.

Are you someone who makes decisions for your company on what documents to share with outsiders? If not, then this is a red flag.

However, im confused whether or not I should share it as he could have easily copied it and taken it while he was working here or in his notice period but he is asking me to do it now.

Most contracts have clauses saying that if you leave the company you're not allowed to take company documents with you. If he'd copied the document during his notice period, he would have been liable.

This is somewhat a confidential doc you can say as its related to sales.

Sales documents aren't just "somewhat" confidential; most companies consider them key competitive/strategic information.

He said his new company where he is working is different and does not have any similarity to us however he wants this document just for reference.

Doesn't matter. He's not with the company, he doesn't have any right to company confidential data. Even if you don't know about any bad thing he might do with them. They're confidential, that's all the reason you need to deny him.

I find it a bit fishy and im worried if this might affect our business or Im I just overreacting?

He's asking you to do something now, that if he had done himself back then, could have gotten him sued. Right now, it could get you fired and/or sued. Yeah, it's fishy.

As an aside: what constitutes confidential data? As a rule of thumb, any data not available to the general public.

  • Sales prices for consumers: not confidential.
  • Sales prices for business customers who are getting a special discount or have some kind of cheap grandfathered contract: confidential.
  • The real prices at which you purchase stock (perhaps with a discount because you're a big buyer): confidential.
  • Which products are going on sale next month: confidential.
  • Which products are on sale right now: not confidential.
  • Current sales figures: confidential.
  • Sales figures published in a press release: not confidential.

You should consider whether you should warn your current manager that your former manager is snooping around and asking for this document. If he gets hold of it, perhaps from someone else careless, suspicion might fall on you (since you have access and knew him).

Improve this answer
4
  • 1
    "Sales prices for consumers: not confidential." Even that isn't necessarily true. There's a big difference in how the data is available. Say you're a super market chain: Sure all your prices for your products are available for everyone who visits one of your stores, but that's still very different from a database that contains all stores, their products and their current sales prices.
    – Voo
    Dec 17 '19 at 11:13
  • @Voo sure, but "generally available to the public with reasonable effort". This does sometimes trip up companies though, for example when price comparison websites make such prices a lot more easy to compare between supermarket chains. If your company is trying to hide behind an opaque (but technically public) price structure, you should indeed not publish an easy reference guide. Leave that to marketing and sales to decide. When in doubt, if you're not in charge of publicity, keep your mouth shut.
    – ObscureOwl
    Dec 17 '19 at 12:01
  • 2
    My point is simply that evaluating what is confidential and what isn't can be way more complicated than immediately obvious. If it's not your job to publicize material don't do it even if you think it is not confidential.
    – Voo
    Dec 17 '19 at 12:18
  • 1
    "what constitutes confidential data?" - I think the rule of thumb here is more like "Everything, unless otherwise clearly and specifically stated in writing".
    – David Spillett
    Dec 17 '19 at 14:31
9

Your ex-manager doesn’t work at the company anymore and has no rights whatsoever to these documents. Tell him as politely as you like that you are not going to send these documents to him. If he tries to reason with you tell him as politely as you like that you are not going to send these documents.

Also inform your manager and HR about the request, in case he approaches others. Do NOT tell that you thought about sending these documents for even a second; sending them would quite likely get you fired on the spot.

Improve this answer
1
  • Manager, HR, and the head of Security.
    – John R. Strohm
    Sep 16 at 4:00
9

This person is trying to steal confidential information by spear phishing. Report this behaviour to your superior immediately.

The fact that he does not have access to this document is intentional. If your company wanted ex-employees to be able to access documents, it could easily set this up.

Improve this answer
6
  • This is a very insightful point. This might not even be him making the request. And once that person has that sales document, they could send a fake invoice to your client.
    – Stephan Branczyk
    Dec 17 '19 at 9:10
  • How is this spear phishing? I mean, the 'spear' part of aiming at an individual fits, but it is in no way phishing, at least not that we know. They seemed to have had phone contact, so I they they're quite up-front about who they are?
    – Nanne
    Dec 17 '19 at 10:27
  • would assume PEAR fishing .. don't have any clue what spear fishing would be other than a medieval fish catching method still used by native tribes near rivers and coasts
    – eagle275
    Dec 17 '19 at 10:31
  • @Nanne Just because they are upfront about who they are, doesn't mean it isn't phishing. Using former - and no longer valid - authority to suggest that they are still allowed access to the data would still be fraud by false representation. Barack Obama can't access classified military records by virtue of being the former President: he no longer has that permission.
    – Chronocidal
    Dec 17 '19 at 14:08
  • 2
    It is definitely stretching the definition. However, I could not find a better term. His ex-manager is maliciously posing as someone who should have access. It's not the identity he's faking, but his access level.
    – knallfrosch
    Dec 18 '19 at 7:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .