USA 
United Kingdom
Last week, HR Grapevine shared the news of a former Minnesota Timberwolves employee arrested for stealing a hard drive and copying 5,700 files including sensitive employee and player contracts.
We also covered the news that the Commodity Futures Trading Commission fined U.S. Bank $6million for employee communication violations, in the last of a series of charges against Wall Street giants who aren’t keeping employees in check with using private channels like WhatsApp messages.
There have been other major incidents in the past twelve months. An insider threat data breach at Verizon in September 2023, but not identified until December, gave an employee without authorization access to the names, addresses, Social Security numbers, and more of 63,000 current and former employees.
In May 2023, Tesla found two of its former workers responsible for a data breach of similar personal information for over 75,000 employees. Even soccer club Manchester United has been in the headlines for a historical data leak.
In fact, the number of data breaches has steadily been growing over the past twenty years, with cases spiking from 1,802 in 2022 to an all-time high of 3,205 in 2023.
’The Cubicle Culprits’: Why should HR be concerned about data breaches?
Whilst data breaches involve multiple stakeholders from teams in information security, risk, compliance, legal, and more, HR also has a major role in addressing this alarming rise.
According to a report from Cyber Haven – which analyzed the behavior of over 3 million workers - work patterns such as in-office or remote work and incidents that cause employee frustration have a huge impact on the prevalence of data breaches.
It can be easy to put the growth in data breaches down to the rise in remote working, the theory being that as flexibility increases, so does the ability to flaunt company guidance and regulation. However, the speed at which incidents increased did not accelerate as remote work exploded in 2020, and Cyber Haven’s analysis actually points to the ‘Cubicle Culprits’ – i.e. in-office workers – as more likely to be responsible for data breaches.
Employees with a fully in-office work arrangement were 77% more likely than fully remote employees to exfiltrate data.
However, the real risk comes from designated in-office employees who happen to be working off-site. These employees are 510% more likely to take data when not at the office.
Whether these incidents are intentional or accidental, HR must pay particularly close attention to how in-office workers behave when they are out of the office, keeping them firmly in line with policies about data protection.
The other remarkable finding in the report is how significantly the number of incidents accelerates in the days before a layoff. In the 24 hours before a layoff, for example, Cyber Haven finds a 720% increase in data exfiltration incidents.
“Whether because workers sense that they may lose their jobs or simply prepare to leave on their own is unclear,” Cyber Haven acknowledges. However, this is where HR can act.
Through monitoring, engagement surveys, and other forms of employee listening, HE teams should be aware of when employees are anxious or uncertain about their future, and when they are disengaged or considering leaving the company for another purpose. As well as working with employees to unpack the uncertainty and disengagement, this is a perfect opportunity for HR to determine high-risk scenarios and work to prevent acts of theft or retribution that threaten data privacy.
As the report says, “Understanding the real dynamics of insider risks is the first step in preventing potential data security incidents.”
By understanding what may trigger employees to consider stealing or accessing data without authorization, HR can help organizations avoid breaches. Crucially, electing to remove all trust and use data breaches as a reason for return-to-office policies is possibly the most dangerous move they can make.
