Hot answers tagged

83

First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally, I would download it so you have a reference. You should take screenshots of your own data and avoid data that is not yours. Make sure you include the URLs. Document those in a way that a lawyer can understand. This is likely to become a legal ...


26

You typically want to contact the hosting company to take it down and hold all data and logs under a legal hold. You could also contact the other companies affected. Legally, you will need to contact a lawyer and the law enforcement in your jurisdition.


20

It should go without saying, but make sure that those login credentials are not working on your system. If they weren't deactivated when he left your organization (when they should have been), you'll want to audit your access logs to make sure they haven't been used since he left -- if they were on a public website where anyone could find them, you should ...


17

If you are a regular member of staff at the company, your correct escalation should be through the Infosec team, and fall back to the Legal and IT departments if your company isn't big enough to have a dedicated Infosec team. I would also copy HR on any communication. This is an extremely serious scenario. If you don't know what to do (and the fact that ...


8

For getting it taken down, you could have a US lawyer issue a DMCA takedown notice to the hosting provider, asserting that you own the content and have not consented to it being distributed - this should get an immediate reaction if the hosting provider honours DMCA notices, to which the contractor can respond.


2

I have been in a similar situation. I contacted my boss and the owner immediately (we only had 25 people). The owner handled everything, but he asked me to be available for a phone call. Since this involved a DOD contractor in the US, it was a DOD responsibility. We were never told the outcome. Let the owner/COO/corporate counsel contact law enforcement. ...


1

This is an addition to the other answer from the top (currently). I understand it's been 3 days already and we won't see an answer from OP, but I strongly suggest to anyone that will have this happen to them to consider the following. Understand how data leaks usually happen: third party contractors are targeted first. I will tell you that even the lowest, ...


Only top voted, non community-wiki answers of a minimum length are eligible