Exposing employee numbers, how bad is it?

Question

I've realised that there is an easy way for someone who is external to figure out valid employee numbers at my company.

And I'm fairly sure they could then be linked to a full name easily too.

I've raised this as a concern with our security team as I don't particularly like the idea but it's been brushed off as a fairly harmless thing to know valid employee numbers. I feel my concern over linking it to names was either badly worded or skipped because it wasn't addressed at all.

Am I right to be concerned or am I overthinking it? I don't really want to push back or do further testing if I'm being irrational.

Answer 1

I would say that is a significant risk for several reasons, being:

1. Even if employee numbers are not currently used as an ID method, they might be used in the future for this purpose. Some companies will use an employee number as a username as well, so if the attacker can find this and correlate it to a person's real given and surname then this would empower user enumeration.

2. When end-users call or are called by support staff, it is far more convincing when the caller has access to even basic knowledge such as the employee's number. As most people will presume that only authenticated + authorized individuals will have the number it could allow an attacker to perform an social engineering attack.

3. Phishing and malicious emails can be made more convincing as well; the attacker can use the number and the person's name in the email.

4. If the employee numbers are easily found, there might be more severe exploits that have gone undetected. In addition there might be an exploit tied to how the numbers are found which is more severe but as no one has looked at this issue it has gone unnoticed.

5. If the employee numbers are meaningful (e.g. contain division, can infer which employees have been there longer due to lower numbers, type of staff such as contractor or part-time etc...) then this would also help immensely with OSINT for a targeted attack or spear phisihing.

6. If anonymity is expected by staff, this could violate this expectation. I doubt this is a major issue as it is easy to find where someone works through Facebook, LinkedIn, etc...

Hope this helps. My only advice as for pushing further on it or not is just to clearly communicate your concerns (with written evidence of course) and respect the decision by whoever is authorized to make it.