this post was submitted on 07 Mar 2025
748 points (99.2% liked)
Not The Onion
14287 readers
2596 users here now
Welcome
We're not The Onion! Not affiliated with them in any way! Not operated by them in any way! All the news here is real!
The Rules
Posts must be:
- Links to news stories from...
- ...credible sources, with...
- ...their original headlines, that...
- ...would make people who see the headline think, “That has got to be a story from The Onion, America’s Finest News Source.”
Comments must abide by the server rules for Lemmy.world and generally abstain from trollish, bigoted, or otherwise disruptive behavior that makes this community less fun for everyone.
And that’s basically it!
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Last organisation I worked for—not for profit, health—had around 17,500 employees. One of the cybersecurity managers had every employees details and devices on a Google Sheet private account that anyone could see if they had the share URL.
Home addresses, phone numbers, MAC addresses, IMEIs, columns of PII....
I started getting all sorts of unsolicited contact and 2-step authentication alerts "randomly" after two months there and 8 months later rEvil successfully ransomwared for $3.4M.
So when I found this sheet and no one took it seriously, I declared an internal data breach, submitted it to the fed—as you legally must in this country—and shit hit the fan for that department.
I recently had to submit some PII to my employer. The person requesting that information invited me to a video meeting so that the information wouldn't easily be accessible on record.
I've been working in this field for around fifteen years. This was the first time someone in charge of handling my information has even pretended to care about it.
You are a legend
That is fucking amazing.
Please tell me this 'cybersecurity manager' was... fired, or drawn and quartered, or something.
I don't think so. No one higher up quite understood the severity, even after the ransom event. I kind of established the impression that not-for-profit c-suites are full of the leftovers. If they were any good, they'd be elsewhere earning much more.
Probably got a promotion.