Desk live·
ForensicPost
Cloud/Analysis/File 25-0807b

HR Platforms Assemble the Data an Employee Cannot Refuse to Hand Over

Bank details, national identifiers, health disclosures, disciplinary records and salary — assembled about every employee, by an organisation the employee cannot refuse.

Constructed geometry · not a chart of case data
TargetHR platforms
ActorMultiple
D. Kennedy12 min readConfidence: medium2 sources reviewed

This file describes the data class behind 25-0806b and 25-1009b, because the corpus has referred to workforce data repeatedly without setting out what it contains.

The Field List Is Longer Than A Bank’s

Legal name and address. National identifier. Bank account. Date of birth. Salary and its history. Performance assessments. Disciplinary records and grievances. Sickness absence, and with it health information. Emergency contacts and next of kin. Frequently right-to-work documentation and background check outcomes.

This desk compared a telecom customer file to a bank’s at 25-0720. An HR record exceeds both, and it includes categories — disciplinary history, health absence — that no commercial relationship generates.

And None Of It Was Optional

The corpus has assembled an absent-consent set: crash-report subjects at 25-0612, credit-file subjects at 25-0727, children at 25-0927, alumni at 25-1028.

Employees belong in it and are the largest population in it. A person cannot decline to give their employer a bank account, cannot choose the HR platform, will not be told its name, and cannot leave the dataset without leaving the job.

Concentrated In A Small Number Of Vendors

A handful of platforms serve a very large share of the world’s large employers. That is the structure at 25-0105, where 18,000 schools shared one student information system, applied to employment.

The corpus recorded at 25-0815b that this concentration did not fail in 2025 — the boundary between a vendor’s corporate estate and its customer tenants held. That is worth stating precisely because the exposure would otherwise be the largest in this database.

With No Register Recording Any Of It

The finding at 25-0704 stands: workforce exposure has no public register in any sector, and the corpus sees it only when another route surfaces it — the securities filing at 25-0923b, the multi-population disclosure at 25-1011, the vendor incident here.

Graded medium: this describes the category generally and is not a claim about any specific platform’s contents.

This is an analysis file

It describes what HR platforms generally hold, read against the incidents in this database. It is not a claim about any named vendor. Corrections: corrections@forensicpost.com.

Sources
  1. Workday data breach preventionK2view
  2. Workday data breach 2025: what was exposed and how it happenedSecurity.org
D. Kennedy
Identity and access reporter. Former DFIR consultant. Signal on request.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary