My HR dept leaked some data to a scammer, take any action or ignore?
I'm in some big multinational. I didn't get my salary of last month; thought I'd give it a couple of days. Then HR contacts me, asking whether I really did not get my salary? What turns out:
- someone with some personal email address (which didn't contain any part of my name) contacted HR with my name, asking to change my bank account details
- HR did (!), without at least asking to re-send from the professional mail account, preferably even signed and encrypted (as is nicely integrated in our email solution).
- At pay day, HR transferred the salary to this new bank account
- This scammer contacted them again, saying the salary was not received; could they please transfer it again?
- HR sent them some proof of payment, revealing some data related to me (legal entity of my employer with address, exact salary of that particular month)
- After that, HR thought to probably ask me, at which point the fraud became clear.
What makes me feel bad particularly, is the data related to myself that leaked to this scammer in the process.
What would you do? Simply express how uncomfortable I am with that and forget?
I don't want to 'punish' the HR person that eventually made the mistake. But I also am upset that they leaked this data.