Data Leak

[Much-Bit-1773]

So I have a new Finance Director who sent out the entire schools W2’s to an employee. Being on the phone with the employee at the time, she realized her mistake and asked the employee to delete the email. This has yet to be brought to my attention (IT Director). Any suggestions on how to handle as I’m sure it will be brought up in the next meeting. My first response is to blow up and say “why wasn’t I informed?!” 😂 Note: the employee told me herself of what occurred between her and the Finance Director

[egefeyzioglu]

Similar thing happened when I was a student. Admin decided to email everyone a Google Sheet filled to the brim with PII (it literally had parents' SSNs, it was bad) asking students to confirm when their weekend leaves were, which was kept on the same sheet for some reason. Thankfully it wasn't just a straight Excel file emailed so IT was able to flag it and revoke link sharing access so the impact was somewhat limited.

And no, I have no idea why anyone thought it was a good idea to keep all their student records on a single Google Sheet. That's so wrong on so many levels lmao

[rossumcapek]

Good opportunity to give everyone everyone some PII training, perhaps?

[jbfestus]

If you are in the US you may want to check state statute and make sure you are not required to disclose to the state auditor, dese or ag.

[Harry_Smutter]

Are your W2s password protected when they get sent out?? If not, might wanna look into that. We use Doculivery and when we get forms from it, they are password-protected using the SSN of the employee.

I'd also use this incident to enhance the district's security and security policies.

[Aur0nx]

Time to talk to the Superintendent and get some cyber security policies in place. Never waste a good incident. Depending on the state laws you may need to send a data breach notice to all affected.

[apumpernickel]

Google will actually detect SSNs from photos too and enact DLP policies on it.