What Is Your Employee Telling Your Hacker?
To prevent security breaches, it's not enough to partner with or hire one of the best IT companies available. Employees must also stay up to date on cybersecurity protocols.
Oversharing at Work: A Hacker’s Best Friend
While hackers are getting more and more sophisticated technologically, they still rely on simple aspects of human psychology to succeed. You might not realize how easy it is for employees to give information over to malicious individuals—whether they share passwords with disgruntled colleagues or fall for baiting on social media. By enhancing cybersecurity awareness training, you can uncover whether employees are oversharing.
Here are some ways your employees might be handing over sensitive information to hackers:
1. Your Employee Is Using Social Media to Tell Hackers How to Target Them
Many people feel at ease on social platforms, assuming their posts are only visible to trusted friends and family. Unfortunately, that’s rarely the case.
The hackers often mine social media for company-related details. Even seemingly harmless posts—like a casual mention of an internal policy—can be weaponized to build trust and manipulate future interactions.
As a result, what hackers do with social media is extremely insidious. If an employee shares a seemingly harmless detail about the organization—like a policy that doesn't seem important—hackers can use that detail to create a false sense of trust.
Forbes outlines how this process, called social engineering, allows hackers to use small details in later communications. Believing only trusted individuals would know such information, employees may mistakenly share more.
To avoid this, never allow employees to share internal practices—especially confidential policies—under any circumstances.
Malicious actors also use baiting. In this tactic, they analyze social media interests and craft personalized emails. For example, if someone shares a love for cat videos, a hacker might send a malicious link disguised as the “cutest kitty video ever.”
2. Your Employee Is Literally Giving Information Away via Phone or Email
"Hi, this is Joe from IT. We noticed a problem with your password and we're going to need to reset it."
Also, hackers exploit our natural trust in authority. Consequently, employees may believe they’re speaking with a legitimate IT professional. Train them to never give out passwords over the phone.
Email poses the same risk. Employees must understand that no legitimate IT department will request password changes via email. Teach them how to distinguish real IT messages from phishing attempts.
Another common trap involves downloads. Cybercriminals know people want to be helpful. If an email from “IT” asks them to download a file, many will comply without question.
To reduce these risks, emphasize:
- Be suspicious of any request labeled “urgent.” Cyber hackers use urgency to pressure users into clicking malicious links.
- Watch for typos, which often signal phishing attempts.
- Hover over embedded URLs to preview the destination. Train employees to pause before clicking—even if the email appears to come from HR. And never, ever click unsolicited cat video links.
3. Your Employee Is Giving Hackers Access to Lost Mobile Devices
Mobile phones are both a blessing and a curse in business. They provide access to information anytime, anywhere—but they’re also easy to lose.
To mitigate this risk, train employees to protect their devices while traveling. Require strong passwords on all mobile devices and tablets. Just like at work, they should never leave devices unlocked in public.
If a device is lost or stolen, employees must report it immediately. Ensure your company has a clear reporting process in place.
4. Your Employee Is Sharing Sensitive Information... with Other Employees
No one wants to believe their own employees could steal data. It’s easier to imagine a hacker in a dark basement than a trusted colleague.
Yet according to Statistic Brain, employee theft of workplace data costs U.S. businesses around $50 billion annually.
In some cases, a disgruntled employee might not act alone. They could shoulder-surf for passwords, use USB drives to extract data, or trick coworkers into sharing sensitive information.
To prevent this:
- Prohibit password sharing.
- Enforce a strict USB device policy.
- Immediately revoke access to email and networks when an employee leaves.
- Encourage employees to say “no” to suspicious questions—even from coworkers.
Yes, IT support is essential to your company’s security. However, your employees are just as critical. Train them to recognize when, how, and where to share sensitive information.
For support and user training in hacking prevention, please contact us today.
