Unencrypted hard drives with payroll data, including names, bank account numbers, compensation info of 29,000 Facebook employees, stolen in a car break-in
Kurt Wagner / Bloomberg :
Context & Ripple Effects
This lands in a year when Facebook's security record was already under strain: in March the company admitted it had stored hundreds of millions of user passwords in plain text, searchable by its own employees. The stolen drives extend the same failure mode from user credentials to employee payroll records — names, bank account numbers, and compensation for 29,000 staff sitting unencrypted on removable media.
The incident also echoes a broader 2017–2019 run of careless-data stories across big tech, from Honda's unsecured database of 134M rows of employee systems data to Uber's 2016 breach cover-up that cost its CSO the job. The difference here is the vector: no hacker intrusion required, just a car break-in.
First-order effects
- Roughly 29,000 Facebook employees are directly exposed to bank-account fraud and targeted phishing using their real compensation figures, and Facebook faces immediate notification and remediation costs for them.
- The company must answer why payroll data was on unencrypted portable drives at all, a question made sharper by its own plain-text password admission months earlier.
Second-order effects
- HR and payroll vendors serving large tech employers will face renewed customer demands for encryption-at-rest defaults and tighter controls on removable media, since the weakest link here was physical handling rather than network defense.
- Competing employers can expect employees to ask pointed questions about how their own compensation and banking data is stored, turning an internal lapse into a cross-industry benchmark.
Third-order effects
- If the pattern holds, regulators and courts will treat employee data lapses with the same severity as consumer breaches — the Uber case already showed executives personally absorbing the consequences of mishandled incidents.
- Physical-media thefts like this push the industry toward eliminating unencrypted local copies entirely, concentrating sensitive records in access-logged systems where every touch is attributable.
The trend: Corporate data security is expanding from protecting customer accounts to enforcing encryption and accountability over employee records across their entire lifecycle, with executive careers increasingly on the line.