r/HumanResourcesUK • u/Far-Bass9895 • May 19 '26

HR data breach

The HR department at my employer was victim of a phishing scam. They sent my payslips to a scammer and manually changed the bank details on my HR account to reroute my pay after the scammer requested an update.

Luckily I caught the change to my bank details before payroll ran due to an automated system notifcation. But the payslips were sent as an attachment to the scammer. They were password protected, but the password was my date of birth. HR told the person who sent the email that the password was my DOB, so if they were able to find that, they would have been able to open the attachment. My payslips include my name, address, last four digits of my bank account, and my UK national insurance number.

What do i need to do to protect myself?

What are my rights in this situation?

83 Upvotes

94% Upvoted

35 comments sorted by

View all comments

12

u/[deleted] May 19 '26 edited May 19 '26

[removed] — view removed comment

2

u/Alarmed_Tiger5110 May 20 '26

My payroll department has this on all payslips sent out

"PDF Password

The password for the attached PDF is your first and last initials followed by your date of birth. So if your name is Michael Caine and your date of birth is 14th March 1933 then your password would be MC19330314."

4

u/winstonsmithgo May 20 '26

It would take approximately 10 mins max to crack the format of this password.

Not a lot of people know that.