I've realised that there is an easy way for someone who is external to figure out valid employee numbers at my company.
And I'm fairly sure they could then be linked to a full name easily too.
I've raised this as a concern with our security team as I don't particularly like the idea but it's been brushed off as a fairly harmless thing to know valid employee numbers. I feel my concern over linking it to names was either badly worded or skipped because it wasn't addressed at all.
Am I right to be concerned or am I overthinking it? I don't really want to push back or do further testing if I'm being irrational.