To think this is a huge data breach?!

[whattothinknow]

Hi all,

⚠️ Sorry this is a long post!! ⚠️

So I left the company I worked for, for 4 years - around 8 months ago.
I had made a really good, life long (or so I thought) 'friend' and we worked side by side in the office together for the entirety of my time within the company.
We were really close, would talk about everything - she was the first to congratulate me on my house move, my engagement etc and was always super lovely and supportive. I found I really confided in her like a best friend, and she did the same to me.
We would go out after work, on weekends.. sleep over at each others house after nights out, etc.
I was always going above and beyond for her, doing favours, lending money etc and didn't ever think twice about doing so.. after all, we were best friends.

When it came down to organising my wedding, she was there for me. She came to my dress appointment, was there when I said yes to the dress.
She came to the venue viewings, and was there when we said yes to our dream venue..

I asked her to be my maid of honour - and she was delighted and cried her eyes out at the gesture - it felt very genuine and I was honestly over the moon to have found such a great friend in a work colleague.

Fast forward a little - I left the company at the 4 year mark and moved onto a different department in the same business.
We were no longer sitting together in the office, and I was commuting to a different area of the country for work (same business)

We slowly lost contact - I would always reach out to see how she's getting on, check on her and be there for her. She never responded.
She would dig for information from me as and when she wanted to know gossip or what was going on in the company, but when I suggested meeting / wedding planning she would completely ghost me.. although I could see that she was online and active on various social media platforms constantly.. it made me feel quite uneasy and as though I'd done something wrong?!

I was then getting constant messages from another lady within our team, again digging for personal information from me - how much the wedding venue is, how much my dress was, how my relationship is going and how much my new salary is. I didn't feel comfortable disclosing any of this information, and didn't even really speak to this lady in the first place so this felt very odd.
I confided in my 'friend' and she apologised in the other colleagues behalf and said she will have a word and ask what's going on and why she was asking such sensitive information. Turns out from chatting to a different ex. Colleague in the office, the 'friend' was asking the other colleagues to dig for information from me and hound me. Really confused by this as I left the company on really good terms and was on good terms with this friend, before now.

I have since heard from two ex colleagues that I was fairly good friends with, to tell me that 'friend' had been awful and snide behind my back, even whilst I still worked there and sat NEXT to her in the same office (so before my move within the business).

She said awful, awful things about DP, claimed that I was with him for his wealth and that alone.

She said my engagement ring was tacky and fake, and way too big and 'slutty' for her liking and I didn't deserve such a large statement ring (I can assure you that it is a gorgeous subtle ring, and it is real, not that this should even matter as it's the act and the thought that means the most)

She was nasty and patronising about my weight, telling everybody that I 'barely squeezed' into my wedding dress (she was there when I said yes to the dress) and it made me look like a whale.. 😔

She was openly bitter and jealous when DP bought me a lovely diamond bracelet for my birthday.. I wore it every day and when she first caught a glimpse of it she asked me who got it for me, where from, if it was genuine etc.
I found this strange but replied 'yes it is genuine, it matches my ring, I adore it - it's so special to me!' And she didn't respond to that. Should have thought at that point, that that was strange.. 🤦‍♀️

What I heard next from the two ex colleagues completely blew me away. I was absolutely distraught and still feel well and truly betrayed. I have been in tears over this 😔

During my time in the company, I was having disputes with the management over my level of pay. We were on a commission scheme and I was doing a different role to the rest of my colleagues in the office (the role was hugely demanding, used to take 5 staff members to do this role but sadly as they left one by one, nobody was employed in their place so if came down to me carrying this role out alone) I was taking home £500/£600 less than the rest of the team a month for doing 5 times the work that they were. Never once was I bitter about this to them, but it did hurt knowing I was being taken advantage of by the company..

The 'friend' decided one day when I was away on holiday, go log into my PC (who knows how as it's all private passwords - but she did sit next to me so wonder if she made note of them...)
She logged into my HR system, and decided to scroll through my PAY SLIPS and check that I was 'bringing home less money than everyone else' for herself.

I feel utterly betrayed by this, and my blood boils when I think about it.
I feel like my personal details have been exposed. She can get no end of personal details from those payslips.

If she had just asked me to see them, I'd have probably shown her myself.. I had nothing to hide and wasn't fabricating my situation with the pay..
She was my maid of honour. Someone I confided in and thought of as my best friend and she's completely betrayed me.

I am now torn and don't know what to do. This to me, screams GDPR breach but the problem
is, is that I've got no evidence of her doing it.. only two eye witnesses.

I don't know what to do.

Am I being unreasonable to be completely gutted by this?! I can't seem to let this slide ☹️

I'll be the first to hold my hands up and say I think I've been really bloody stupid and very naive.

But this isn't playground drama - this was my best friend. And it really hurts to find out later along the line that she's done so much to betray me. I think what hurts the most is that I'd have done anything for her - and have gone above and beyond in helping her out of debts, tricky situations and lent large amounts of money - but again that was my decision to do so and at that point in time she gave me no reason not to trust her.. I can completely see looking back, how stupid I've been. X

@PegasusReturns
OP no longer works there, she left eight months ago and this incident is just now being told to her by ex-colleagues as happening sometime during the four years she worked there.

So she’s not obligated to report anything as she is no longer an employee there.

I've experienced similar. Instant dismissal for the woman who left her adult son logged on to her work account at college!

[quote whattothinknow]@AlternativePerspective very true and I'm always open to an alternative perspective.

I personally feel that I trust my own judgement very well, I know this woman like the back of my hand and I know that she does have a cruel and nasty streak and have come face to face with this side of her myself a while back - so I do truly believe she could be capable of saying these things.

I don't know. I'll probably leave it. [/quote]
This is a contradiction. Either that, or you were happy to be her friend when she was only being cruel and nasty to other people.

Either way, the two ex-colleagues are playing you now because she's been promoted above them.

Honestly, this is a viper's nest and you should leave well alone.

I'd report her. If you were on leave at the time then it cannot have been you that logged into your account. Yes, you may be asked if you left your passwords anywhere - you can honestly say that the only thing you can thing of is that she watched you input them. Even if you had left them lying around (which would be silly) the offence is hers for logging in on someone else's account. I wouldn't even hesitate to report her. She sounds like a spiteful jealous bitch and I would guess everyone listening to her saying this stuff thought the same as well.

I can completely see looking back, how stupid I've been. X No! You really haven't. Ignore the posters here who seem to want to ridicule you, they are playing the same game she was, it's easier from behind a screen!

You've been normal. Done normal thngs. Been you!

She's the one who has stepped over boundaries.

Leave her to it.

And maybe walk away from this thread now. You can hide it

@ShowingOut the time I saw her nasty streak was when she did it to me.. hence why I can see that she would do if again.

This was in front of the entire office so again, people will be able to confirm this.

I will be leaving well alone - I've learned my lesson

I'm so sorry she has betrayed you this way, OP. She's no loss if you choose to wash your hands if her.

In your position, I would write to the appropriate HR department, explaining what you have been told and asking if it's possible to investigate after such a long period of time. If yes, and you can prove you were on leave, I'd ask for it to be taken further, even if it's just to scare her. If not, be relieved she's out of your life, block her and any other ex colleagues who might be fishing for her and have your revenge by making sure she doesn't upset you.

Thank you for your opinions everyone - opposing or not.
I'm now
In a hard place where I don't know if I should be raising this, or if I'm best to cut my losses and save my dignity and the fact that I left the company on good terms.

The pay issue was resolved and I worked many more happy months in the role before naturally moving on.

I worked with someone who did something similar. They were suspended immediately and the computer was taken away by IT to look at the history. The person was then sacked as the evidence was clear as day on the system.

I have too. Several times. But my IT has said this only works if the employee account is active. With an ex employee their accounts are usually deactivated within days of their last day at work and the system log in data record is usually deleted. OP left the job 8 months ago. It’s unlikely that data still exists on their system.

In fact it might be a GDPR breach itself it it were still on the system as it is not basic employment data!

Perhaps if you were thinking of raising it with HR, the best way to approach it would to query with HR whether or not you computer files were accessed between the dates you were abroad. I presume this is information you yourself have a right to access. If it is confirmed that someone did access your information then you have some concrete evidence and you can decide at that point whether to proceed or not. If no access was made then you can forget about it.

OP don’t beat yourself up about being friends with her in the past. I’m always amazed how people can wear a mask and take people in. I’ve had so many frenemies at work I’ve lost count. People will use you for their own gain and it sounds like she is a bitter jealous cow and you are well out of it. By the sounds of it she is getting found out by others so she will get her comeuppance eventually. You could raise the issue now based on the fact that you only recently got new information but they might not be able to do anything. What you don’t know is that this might not be the first instance of her doing this and if she gets away with it it might not be the last. Looking over someone’s shoulder and making a note of passwords to then log in is pretty sinister behaviour. It depends how professionally you think the organisation will handle the complaint. Sorry that might not be much help in what to do but just be very thankful your eyes have been opened and she is out of your life as a friend.

Well aren’t they a pair of shit stirrers?!

Not sure what was gained by them telling you all that seeing as the friendship has already broken down.

Why did they tell you?

How were you regularly checked for GDPR?

How long ago were you on holiday when this happened?

Your previous work may not have records going back that far of who logged on when. Did you have a managed desktop?

Just a thought; if you use the same password for any personal email accounts, change them as there is nothing to stop her going into your personal accounts. Did you ever share your Apple TV/ sky tv /WiFi etc password with her? Maybe she got an idea of your password from that? I lend my sky go to a friend so they can watch sky on a laptop, but it is far removed from any other passwords I use.

Thank you everyone for replying.

My password was very far removed from all my other passwords which she didn't also have access to so I'm really not sure how she got access to my work ones unless she literally was watching over my shoulder she did sit close enough to be able to do this…

@PlanDeRaccordement the OP has said she moved onto a different department in the same business.

In which case I suspect she does have an obligation to report and even if she doesn’t there remains a risk that it will reflect badly on her.

Reading your updates you have no evidence but at lot of ‘he said, she said’. They will likely be able to tell that someone logged onto your PC (if it happened), what they didn’t but not who. It could be one of the others. Or they could be shit stirring and it never really happened.
Walk away and forgot about the situation and them.

And be extremely careful about passwords going forward

This isn’t about friendship. Reporting that you have been informed of a serious security breach (using your password on work systems without your knowledge or permission) does not reflect on you or impact your relationship with the department that you have left. If there is any truth to the breach, there will be more to find as it’s unlikely that it’s an isolated incident.

Op I think that if you are still working for the same organisation then you have a duty to report this. I understand that this isn't what you want to do, but you have a duty to do so. I do wonder though whether the witnesses will be happy to repeat what they have said to you.

You sound like a lovely person, your colleagues less so! Honestly, I am much older than you and I would say that you need to keep your work and personal lives much more separate. Don't give people the opportunity to become so entwined in your life.

Congratulations on your engagement and I hope that you have a fantastic wedding day.

In my firm, IT would not require you to have evidence. The information security team have have tools to access various logs and for forensic analysis that the average user wouldn’t even know about. Perhaps your employer has a published policy that you could refer to?

I would ask IT for logs on when my account was accessed during a specific time frame. They can easily tell if someone logged into your account.

You could easily raise it as a subject access request since you don't work there. They have to oblige and give you the information within 28 days.