83

First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally, I would download it so you have a reference. You should take screenshots of your own data and avoid data that is not yours. Make sure you include the URLs. Document those in a way that a lawyer can understand. This is likely to become a legal ...


26

You typically want to contact the hosting company to take it down and hold all data and logs under a legal hold. You could also contact the other companies affected. Legally, you will need to contact a lawyer and the law enforcement in your jurisdition.


20

It should go without saying, but make sure that those login credentials are not working on your system. If they weren't deactivated when he left your organization (when they should have been), you'll want to audit your access logs to make sure they haven't been used since he left -- if they were on a public website where anyone could find them, you should ...


17

If you are a regular member of staff at the company, your correct escalation should be through the Infosec team, and fall back to the Legal and IT departments if your company isn't big enough to have a dedicated Infosec team. I would also copy HR on any communication. This is an extremely serious scenario. If you don't know what to do (and the fact that ...


8

For getting it taken down, you could have a US lawyer issue a DMCA takedown notice to the hosting provider, asserting that you own the content and have not consented to it being distributed - this should get an immediate reaction if the hosting provider honours DMCA notices, to which the contractor can respond.


5

Viable? Probably not.... Years ago, I read an article proposing placing ads for a topic and targeting them to a geographic location. Then the mere fact that you got billed suggests that someone at the target location was googling your topic. I'm not sure it's very viable, as the author seemed mostly concerned about buying ads for their own name and limiting ...


5

Is there any security advantage of hiding route parameters Yes, if they contain anything potentially sensitive. If you pass information as URL params, either in the query string (?key=value) or as part of the path (/someValue) then these are cached in various places in the browser and host machine. Most restful services expect you to pass some form of ...


2

I have been in a similar situation. I contacted my boss and the owner immediately (we only had 25 people). The owner handled everything, but he asked me to be available for a phone call. Since this involved a DOD contractor in the US, it was a DOD responsibility. We were never told the outcome. Let the owner/COO/corporate counsel contact law enforcement. ...


1

From the linked article: BioStar 2 is a web-based biometric security smart lock platform. A centralized application, it allows admins to control access to secure areas of facilities, manage user permissions, integrate with 3rd party security apps, and record activity logs. It seems that unless you have access to somewhere that uses biometrics for that (...


1

It sounds like you've created a document-template & saved it to the template-gallery in google-docs. This would make your template public. If you're using & paying for g-suite, you can (likely, I haven't tested this) make private templates. But if you're using the public/free google-docs, your templates will be made public. That's not to say your ...


1

This is an addition to the other answer from the top (currently). I understand it's been 3 days already and we won't see an answer from OP, but I strongly suggest to anyone that will have this happen to them to consider the following. Understand how data leaks usually happen: third party contractors are targeted first. I will tell you that even the lowest, ...


1

It will depend on the specific implementation of the specific product and the specific message traffic. Data Loss Prevention tools tend to work in one of two ways: they sit on the network and look at logs, read emails, read file shares; or they are installed as a desktop agent which, the vendors assert, has full access to every keystroke, window, file and ...


Only top voted, non community-wiki answers of a minimum length are eligible