I recently (and embarrasingly) failed an email phishing test at work when I should have known better. At the time I was distracted and not paying attention properly and it caught me out, which proves it's worth doing and I learned from it!

We're only a small company (30 people). Not may people failed. I have since learned that the person running the tests revealed that I had failed during a board meeting.

I don't find this acceptable. I think it's unprofessional and an invasion of my privacy.

I'm currently ensuring I have up to date copies of our internal policies to see where I stand.

Does anyone have any ideas/information on where I can look into how I should be protected by (say) GDPR and any other standards?


An edit for any future readers. Replies so far seem to think I have an issue with being tested, or the results being discussed. I don't! I'm just suprised that I got named rather than an overall score and data of an anonymised nature being used.

  • 2
    Protected against what? All the person running the test do is disclose your failure with the, I assume, previously agreed test. How is that invading your privacy? – Tymoteusz Paul Jun 17 at 13:29
  • 1
    I thought you were going to say they revealed it to other employees, that might be odd, but in a board meeting?? I don't see an issue there... – JJC8008 Jun 17 at 13:36
  • 2
    If it was in a board meeting, I don't see an issue with it. If they had advertised it to the entire company, I'd be a bit miffed. Regardless, there's not much you can expect from a privacy standpoint in this situation unless it's a healthcare/personal matter. Even then, HIPPA/similar doesn't apply since they're likely not a covered entity. In that case, they generally avoid talking about health matters as a matter of respect. You failing a phishing test is fair game. – Havegooda Jun 17 at 13:37

Let it go

I had this happen to me when I worked at a bank. One of my co-workers thought it was fishy (and he worked for IT Security) so we poked around the email and eventually clicked on it. We both got an email berating us over it. Our boss got an email informing him of the need to discuss IT security with us.

We laughed about it and moved on. It never came up again. Nobody from IT came to throw us out of the building. Nobody in IT even bothered to mock us about failing it.

This is one of those things that comes with a gentle reminder and perhaps some light mockery and then disappears forever.

Fighting over it will only get you labeled troublesome and embarrass you far more than continuing on with your job. Failing a phishing test is not juicy gossip. "Employee fights over phishing test" will reach far more ears.

I personally would not have revealed it publicly because some people would find it rather embarrassing, but your proposed cure is more harmful to you.

| improve this answer | |
  • I agree. Thank you for the measured response. Am suprised it happened but need to chill out :) – Chris Jun 17 at 15:00
  • @Chris The fact that you're surprised may be a symptom of the Dunning–Kruger effect. The test is to educate people of Phishing, and you got educated. However, you are surprised by your need of education and excused it with "distractions". Just replace clicking the email with... say, depositing money to a stranger's account and see how that reads. – Nelson Jun 18 at 7:52
  • @Nelson I'm not surprised by being caught out by Phishing, it was a clever attack and you're right it did educate me. I was suprised at my identity being disclosed and the need to do so. – Chris Jun 19 at 9:01

The test was carried out to know how many (and which) employees posed a potential security risk in terms of being vulnerable to this sort of threat. What do you expect the people who are running the test to do if not to report on the results?

I don't find this acceptable. I think it's unprofessional and an invasion of my privacy.

I can understand why you might find it embarrassing but unless they were all pointing and laughing or similar it's not unprofessional. As for your privacy why would it be? Presumably you weren't sending communications of a personal nature when you fell for the phish - you were acting in your professional capacity and the people running the test were acting in their professional capacity when they ran the test and reported on the results.

I should be protected by (say) GDPR and any other standards?

Well, assuming you were in the EU then GDPR would cover the data of the test results - the outcome of the test has to be recorded against some PII for them to know it was you. I mean if you really dig you might be able to find some kind of loophole where they didn't have a suitable lawful basis for the processing/storing the PII for the purposes of the test but I doubt it - and even if you do find anything all you'll really do is suceed in escalating the situation from "OP fell for a phishing test, that was kind of embarrassing" to "OP's a nutcase", you can't un-ring this bell, they already know you failed the phishing test. No amount of right to erasure in the world is going to change that.

Honestly I think you just need to take this like a grown up - and be more careful with your inbox in future.

| improve this answer | |
  • 1
    I'd add that failing those is not career-ending, not even close to it. In every company, I've seen them done someone has always failed, and not once were they met with any punishment for it as that is not the point of them. The point is to educate and expose how easy those attacks are to carry out, and usually in a way that the board will understand. – Tymoteusz Paul Jun 17 at 13:45
  • I think I expected the personal details of any tests like this to be kept private. Surely saying "n people failed" is sufficient rather than naming and shaming? But an interesting viewpoint, albeit written in a rather agressive manner. – Chris Jun 17 at 13:46
  • 1
    @TymoteuszPaul Absolutely.. they're generally run to identify training needs, not as sticks to beat people with. – motosubatsu Jun 17 at 13:46
  • 1
    @Chris The thing is without naming the people who failed the information is of limited value - say they intend to organize training/education on the issue for those who need it. They need to know who those people are. As others have alluded to in comments if they were broadcasting the results then the "n-people failed" approach is perhaps more appropriate, but this wasn't that - it was a board meeting. – motosubatsu Jun 17 at 13:51
  • 2
    @520saysReinstateMonica It's a company of thirty people.. saying "two employees of X division" probably pins it down anyway. And remember - it's the board of directors if they want to know which of their employees failed a phishing test, they're allowed to know, this isn't an employee's deeply personal information - it's the result of a workplace evaluation. – motosubatsu Jun 17 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .