I just stumbled into something that is both bizarre and confusing, and I'm not entirely sure what to make of it.
I'm an IT technician. I sat down on employee Alex*'s desk, after hours, responding to a request for support from Alex's manager (Charlie*) about that computer's performance. All people mentioned were not in the office at this time, by the way.
Alex's computer was left on, with the user logged in and unlocked. The web browser was left open on employee Blake*'s personal webmail page, more specifically in an email with Blake's latest salary receipt.
I'm unsure what to do with this information. On one hand, it's not my responsibility to make sure personal email accounts are secure, and I'm also not absolutely sure that there is something nefarious going on or if there was consent.
On the other hand, this ends up intersecting with the business since the salary receipts are involved, and in spite of that, I also feel like I have a moral obligation to do something about this given that it seems extremely likely that there is something nefarious going on.
Their relationship is distant, as far as I can tell, but I don't know either too well. They don't interact a lot because their functions don't intersect too much. They work in different offices, different departments, but in the same floor. Neither is in a position of power or influence, and there's no hierarchy link between them. It's at least possible that there might be more to this beyond the office, but it's unlikely. Plus, even if Blake wanted to show their salary receipt to Alex, for whatever reason, it doesn't make sense to provide access to their personal email account.
Some more context:
The users' expectation is for us to log in with an admin account, otherwise we schedule support with the user. I don't know if the user knew about the timing of the intervention, since the request came from their manager. Plus, this user always leaves the computer on.
Also, the user session locks after some time, so leaving it unlocked may not be surprising if the user relies on the timeout. Since I started working on it right after they left, it just happened to not lock in time.
The sensitive information left on the screen suggests to me that the user wasn't thinking about my intervention after hours.