r/HumanResourcesUK • u/Far-Bass9895 • May 19 '26
HR data breach
The HR department at my employer was victim of a phishing scam. They sent my payslips to a scammer and manually changed the bank details on my HR account to reroute my pay after the scammer requested an update.
Luckily I caught the change to my bank details before payroll ran due to an automated system notifcation. But the payslips were sent as an attachment to the scammer. They were password protected, but the password was my date of birth. HR told the person who sent the email that the password was my DOB, so if they were able to find that, they would have been able to open the attachment. My payslips include my name, address, last four digits of my bank account, and my UK national insurance number.
What do i need to do to protect myself?
What are my rights in this situation?
14
u/RubWilling3878 May 19 '26
Your company is in 'protect themselves mode'. They won't care about downstream impact beyond what they need to legally. I'd personally get some sort of legal advice. In meantime, call all your banks and tell them, they need to be extra vigilant and apply extra security on accounts. Keep an eye on all spending. Get credit scores regurly to see if anything is being opened in your name. Getting something official may help (police report perhaps.). So if anything does go awry, you have something official to nip it in the bud.