An employee contacts Human Resources on payday. Their paycheck never arrived in their account. The payroll system shows a completed deposit, but the bank account is unfamiliar. Someone accessed the employee’s account and changed the payment instructions. What follows involves payroll, technology, finance and potentially legal counsel. The employee needs help and the company needs to determine what happened, whether other accounts are affected and how to prevent another loss.
This isn’t fiction or a what-if. The FBI has warned that criminals are impersonating employee self-service websites to steal credentials and redirect payments. Payroll, health savings accounts and retirement accounts can all be targets.¹
For benefits and HR executives, cyber risk reaches directly into the services employees depend on. Four questions can help leaders assess their readiness.
Start here: what employee information do we hold, and who can access it?
Needless to say but let’s be clear: Human Resources and Employee Benefits operations involve sensitive information about employees and their families. Depending on the organization and its plans, that may include Social Security numbers, bank details, dependent information, benefits elections and health-related records. That information can reside in HR systems, spreadsheets, email attachments and vendor platforms.
Understanding exposure starts with knowing where the information goes.
HR should work with technology leadership to identify who can view, download or change sensitive records. Access should reflect a legitimate business need and change promptly when employees leave or move into different roles. The FTC recommends limiting access and retaining personal information only when the business needs it.²
Identify whether former employees still have access, whether shared folders contain unnecessary copies and whether vendors receive more information than their work requires.
Second: how do we verify requests to change pay or disclose sensitive information?
A request to update direct deposit information may look routine. So may an email asking HR to send a payroll report to an executive. Familiar names, accurate personal details and an existing email conversation can make a fraudulent request convincing. Verification needs to happen through a trusted process.
Establish a documented procedure for changes to bank details and requests for sensitive records. Confirm unusual requests through a known contact method, rather than a phone number or link supplied in the request. Consider separate approval for sensitive changes and notifications to employees when account details change.
Employee education should also cover how to reach legitimate payroll and benefits portals. The FBI’s warning describes fraudulent search advertisements that lead employees to look-alike login pages.
Providing verified links and encouraging employees to bookmark them can help reduce that exposure.¹ The process should apply even when the request appears urgent or comes from senior leadership.
Possibly this one: what happens if a payroll or benefits vendor has an incident?
A company may experience disruption or employee data exposure through a service provider, even when its own systems remain secure.
Before an incident occurs, HR and benefits leaders should understand:
- How the provider will notify the company and share updates.
- Which employee information the provider holds and how it protects access.
- How payroll or benefits administration would continue during an outage.
- What the contract says about cooperation, responsibility and recovery costs.
- What insurance the provider maintains and how the company’s own coverage may respond.
The Department of Labor recommends evaluating service providers’ cybersecurity practices, incident histories, contractual protections and insurance. It has also clarified that its cybersecurity guidance generally applies to all employee benefit plans, including health and welfare plans.³ Vendor selection is the beginning of that review. Changes in services, systems or access can create reasons to revisit it.
Definitely ask: how would we communicate with employees and support them afterward?
Employees will want straightforward answers: Was my information involved? Will I be paid? Can I access my benefits? What should I do now? HR should help prepare those answers before an incident occurs. The response plan should identify who approves employee communications, where employees can obtain verified updates and how the company will reach people if normal email is unavailable.
During an incident, coordinate communications with technology leadership, legal counsel and the response team. Explain confirmed facts, acknowledge what remains under investigation and provide specific actions employees can take. Avoid assurances that the investigation has not yet supported.
Depending on the incident, support might include assistance resolving payroll problems, guidance on securing accounts or identity protection services. Legal counsel should help determine notification obligations. The FTC’s response guidance emphasizes clear communications and practical steps affected individuals can take to protect themselves.⁴ How the company responds can shape employee trust long after systems return to normal.
How can Sentinel help?
Sentinel can help bring the benefits, HR and insurance perspectives together. We work with your team to understand employee information exposures, vendor dependencies and the financial consequences of an incident. That discussion can inform a review of cyber coverage, applicable limits and the coordination of cyber and crime insurance. It can also help clarify insurer notification requirements and the response resources available under the policy.
Your technology team and legal counsel remain essential partners. HR and benefits leaders contribute the knowledge of employee needs, information flows and vendor relationships, making preparation more effective when you work with Sentinel.
Here’s the key question: If employee pay, benefits access or personal information were affected tomorrow, would your team know how to respond?
Contact your Sentinel Client Executive or visit the Sentinel Cyber Portal to begin the conversation.
Notes:
Federal Bureau of Investigation. Public service announcement on fraudulent employee self-service websites and stolen payroll, health savings and retirement account funds. April 24, 2025.
Federal Trade Commission. “Protecting Personal Information: A Guide for Business.”
U.S. Department of Labor, Employee Benefits Security Administration. “Tips for Hiring a Service Provider with Strong Cybersecurity Practices”; and “Compliance Assistance Release No. 2024-01,” clarifying that the department’s cybersecurity guidance applies to all employee benefit plans, including health and welfare plans.
Federal Trade Commission. “Data Breach Response: A Guide for Business.”
Author: Todd Keenan
