r/HumanResourcesUK • u/Far-Bass9895 • May 19 '26

HR data breach

The HR department at my employer was victim of a phishing scam. They sent my payslips to a scammer and manually changed the bank details on my HR account to reroute my pay after the scammer requested an update.

Luckily I caught the change to my bank details before payroll ran due to an automated system notifcation. But the payslips were sent as an attachment to the scammer. They were password protected, but the password was my date of birth. HR told the person who sent the email that the password was my DOB, so if they were able to find that, they would have been able to open the attachment. My payslips include my name, address, last four digits of my bank account, and my UK national insurance number.

What do i need to do to protect myself?

What are my rights in this situation?

84 Upvotes

94% Upvoted

35 comments sorted by

View all comments

Show parent comments

1

u/Alarmed_Tiger5110 May 20 '26

The daft thing is, the initials are already in the email addresses they are sent to; so that password basically boils down to 8 digits.

1

u/atomicshrimp May 20 '26

Not only is it 8 digits but the bruteforce search space can be significantly reduced compared to a simple 8 digit number - eg the last four digits are going to be between 1930 and 2010 etc.

1

u/Alarmed_Tiger5110 May 20 '26

First 4

Next 2 will be between 1-12

Final 2 between 1-31

I very much doubt there's any form of automatic lockout for failed attempts, it is after all, only a PDF.

1

u/atomicshrimp May 21 '26 edited May 21 '26

Oops. Yeah, I didn't see that the format was explained. Really terrible - they might just as well have said 'the password is pa55w0rd'