Serious breach of data

[Devil666x]

Hello all,

This isnt really a dispute but I'm after some advice.

I used to work for a company. Within that company I had vast amount of access to customer data... I'm talking everything.
I've left this company about 6 months ago but I have just found out I still have access to this.
The reason why I ask here first is that this is a children's services organization. This data is extremely sensitive and I don't want to be in a position where I'm accused of anything.
Also, I didn't leave the company in bad blood per se but while I was there I was unfairly blamed for issues which was acknowledged but I'm still precaucious.
I don't want to go straight to the company and say this in case something comes back to me. But this is a very serious issue.

[nemesis45]

Re: Serious breach of data

Hello all,

This isnt really a dispute but I'm after some advice.

I used to work for a company. Within that company I had vast amount of access to customer data... I'm talking everything.
I've left this company about 6 months ago but I have just found out I still have access to this.
The reason why I ask here first is that this is a children's services organization. This data is extremely sensitive and I don't want to be in a position where I'm accused of anything.
Also, I didn't leave the company in bad blood per se but while I was there I was unfairly blamed for issues which was acknowledged but I'm still precaucious.
I don't want to go straight to the company and say this in case something comes back to me. But this is a very serious issue.

Good morning, welcome to LB,

I advise you to immediately report this to the organisations Data Controller the there can be no come back situation.

nem

[seduraed]

Re: Serious breach of data

As Nem has said an immediate report to the data controller. Immediately follow up with an email or signed for letter to prove you have acted correctly and to have a paper trail.

[paulajayne]

Re: Serious breach of data

How did you access this data?
Is your old login still active?

[Devil666x]

Re: Serious breach of data

Thanks for the replies. I don't know who the data controller is. I do have the email of the ceo and my ex manager.
Just to clear up, I didn't access the data.
I just accidentally discovered I still have access to the system, and the system holds all the personal and company data. The system also has a log to show what data has been accessed etc so in that sense I am ok. (I put the system in place while I was there)

- - - Updated - - -

Yes the login is still active. Even my old password is still the same.

[nemesis45]

Re: Serious breach of data

Thanks for the replies. I don't know who the data controller is. I do have the email of the ceo and my ex manager.
Just to clear up, I didn't access the data.
I just accidentally discovered I still have access to the system, and the system holds all the personal and company data. The system also has a log to show what data has been accessed etc so in that sense I am ok. (I put the system in place while I was there)

- - - Updated - - -

Yes the login is still active. Even my old password is still the same.

Just address the letter /e-mail as follows.

Private & Confidential
For The Attention of
The Data Controller
aaaaaaaaaaaaaaa etc
nem

[paulajayne]

Re: Serious breach of data

Thanks for the replies. I don't know who the data controller is. I do have the email of the ceo and my ex manager.
Just to clear up, I didn't access the data.
I just accidentally discovered I still have access to the system, and the system holds all the personal and company data. The system also has a log to show what data has been accessed etc so in that sense I am ok. (I put the system in place while I was there)

- - - Updated - - -

Yes the login is still active. Even my old password is still the same.

Email admin@"COYNAME". whatever

informing them that they have not deleted "A" login/account.



As your are not employed by them anymore be aware that you have committed a data breach which may have repercussions.

I would set up a disposable email address and use that.

word it so that you will not be implicated.

[Devil666x]

Re: Serious breach of data

Ok now that's worried me.
It seems like it's one of those situations that trying to do the right thing might get me up sh%ts Creek.

[paulajayne]

Re: Serious breach of data

Ok now that's worried me.
It seems like it's one of those situations that trying to do the right thing might get me up sh%ts Creek.

Best option then is to do nothing.

[Sangie595]

Re: Serious breach of data

Best option then is to do nothing.

No, it isn't. The OP has access to children's data. The fact that they may not have accessed it is not relevant. They need to inform the company. It doesn't matter whether they tell the data controller, their former manager or the CEO - but they need to do it and they need to keep evidence that they have done it.

[seduraed]

Re: Serious breach of data

I agree, the OP needs to let the data controller know. How he phrases the email would be as part of a due diligence on his part. So words to the effect of "I was clearing my old log in and just wanted to check that my account had been deactivated . I have to report that it has not been done and wish to report this as a datA breach.