Employee-related data breaches are becoming more commonplace as employers hire third-party providers to handle vital functions, including payroll, benefits, and relocation services. When these outside providers suffer a security breach, employees—not the organizations that hired them—bear the consequences related to identity theft, financial fraud, and privacy breaches. 

A recent data exposure regarding Graebel Companies, a relocation services provider for Merck Sharp & Dohme LLC Data Breach, showed how employee information can be impacted even when the breach occurs outside of the employer’s internal systems.  Such situations demonstrate the importance of employees—both current and former—being aware of what rights and protections they are provided under the law.

What Is the Uniqueness of Employee Data?

Records of employees tend to contain sensitive details like their full names, bank account numbers, tax identifiers, addresses, work history, and direct deposits. The key difference is that, aside from passwords, could be changed in seconds upon noticing a cyber-incident. These are very appealing to cybercriminals.

Here are ways this information could be used:

• Bank or credit card fraud
• Unauthorization loans or tax filings
• Identity theft related to the credit profile
• To indulge in long-term targeting or surveilling for scams.

What to Do if Your Employee Data Has Been Breached

When an employer, or a vendor utilized by the employer (e.g., payroll processing, benefits management, scheduling systems), experiences a breach of data, an employee whose sensitive information was involved generally has multiple legal rights, depending on which privacy laws apply federally and/or in the employee’s state. The most common protections would include:

1. Right to be Notified.

Once the employer publicly acknowledges a breach and/or they find that sensitive employee information was involved, the employer is required to notify the affected employee. The notice should specify:

• What happened
• What information was accessed
• When the data breach occurred
• What the company is doing to fix the data breach

2. Right to Identity Theft Protection

Many states require the breached employer to provide services, including credit monitoring or fraud alert services, that the employee can request for free.

3. Right to Seek Damages.

If a breach of data occurs as a result of negligence on the part of the employer (e.g., the employer did not have a data protection measure in place that a reasonable employer would have used) a breached employee may be entitled to seek damages. Breached employees may seek damages for:

• Time lost recovering from identity theft
• Issues with credit/banking
• Financial losses from fraud
• Emotional distress or harm to personal privacy

4. Right to Know How Your Data is or Was Used.

Employees should be able to ask their employer and/or vendor what types of data they have, how it is stored or secured and how it is or was utilized.

5. Right to File a Claim.

In most cases, an employee is allowed to file a claim against an employer in court on their own or join a group of other individuals for a class action

Reasons to Exercise Caution When It Comes to Workplace-Related Breaches

A breach of employee data can affect an individual long after their employment has ended. Unlike security incidents that affect consumers, breaches at the workplace usually involve more complete identifying information, making the need for long-term monitoring essential.

What steps should employees take as soon as they receive a notice of a breach?

• Read the letter.
• Enroll in any credit-monitoring services offered to you.
• Consider placing a fraud alert or placing a credit freeze.
• Monitor bank and credit activity.
• Keep copies of documents regarding the breach in case of a future legal claim.

Conclusion

As more organizations look to third-party vendors, the possibility of workplace-related data exposure will likely rise as well. Understanding your rights is an important step to protect yourself and seek accountability when an organization mishandles sensitive information. Matters such as the recent matter involving Merck and Graebel only emphasize how essential strong legal and security safeguards have become, not only for organizations but for employees who extend their trust with well-guarded information.