I had an employee provide a resignation before I was on site. The employee then unplugged a desktop computer and left the premises with it. The computer contained pricing data, customer data, email communications, login credentials to several important websites, login info to vendor websites.

I filed a police report and the police were able to recover the computer, however the data on the machine was wiped or the drive was replaced.

What should I do?

  • elekchen@alien.topBEnglish
    1·
    10 months ago

    Following the suggestions by ChatGPT (GPT-4), I hope they can be helpful to you:

    "Yikes, that’s quite a pickle you’re in! First off, good on you for filing a police report – that was absolutely the right move. Now, dealing with the aftermath of the wiped data, here are some steps you might consider:

    1. Data Recovery: If the drive was wiped but not replaced, you might have a shot at recovering some data. There are professional data recovery services that specialize in this sort of thing. It’s not guaranteed, but it’s worth a shot.

    2. Change Credentials ASAP: Since the computer had login info to various websites, change those passwords immediately. This is crucial to prevent any further unauthorized access.

    3. Assess Your Data Backup Situation: If you have backups (and fingers crossed you do), now’s the time to use them. If not, it’s a tough lesson in the importance of regular backups. Cloud storage or external drives can be lifesavers in situations like this.

    4. Review and Improve Security Measures: It’s vital to assess how this breach happened and strengthen your security policies. Consider things like encrypted data, restricted access, and more robust internal security protocols.

    5. Legal Action: Since there’s a clear case of theft and data destruction, discussing with a lawyer about potential legal actions against the former employee might be necessary.

    6. Notify Affected Parties: If customer data was compromised, it’s usually best practice (and sometimes legally required) to notify those affected. Transparency is key here.

    7. Learn from the Incident: Use this unfortunate experience as a learning opportunity to improve your organization’s data security and employee exit protocols.

    Remember, hindsight is 20/20. It’s easy to think of what could have been done, but focus on what you can do now to rectify the situation and prevent it from happening again. Hang in there! 🛡️💻🔒"