this post was submitted on 08 Jan 2025
31 points (100.0% liked)
Data Breaches
1517 readers
38 users here now
Information about data breaches, data leaks, ransomware attacks, and other related stories.
Companion communities
- !cybersecurity@sh.itjust.works - centered on the cybersecurity and information security profession.
If someone is interested in moderating this community, message @brikox@lemmy.zip.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Lol its kind of funny you can just export all that sensitive data to a excel document and they didn't have rotating passwords
Exporting from almost any database software to Excel/spreadsheet/some other easily audited/human readable format is a pretty standard feature, is pretty useful for troubleshooting, and for ingesting into other tools and systems when there isn't some proper path through API.
That said, all of that private data should only be accessible in that form by a break-glass account properly secured with pass rotation.
But I know that there's probably 5 personal accounts at my workplace in our HR/Payroll software that could export the full data from it to Excel. A lot more that could export everything except the payroll info. Unfortunately that was a project that didn't involve any tech staff until four months before it was supposed to go live, and was configured entirely by a third party vendor "for security" and so we wouldn't peep other people's pay. That's all to say that something like this breach isn't super surprising to me.
Good info!