u/Syncplify

A new report from Cifas found that 13% of surveyed workers have either sold their company login details in the past year or personally know someone who has, which is already a pretty uncomfortable number, but it's not disgruntled junior employees feeling underpaid and overlooked doing it, it's the people at the top.

32% of senior managers, 36% of directors, 43% of C-suite executives, and a genuinely baffling 81% of business owners consider selling company credentials to be "justifiable," usually under the assumption that it's harmless one-time access - as if handing someone a working set of login details doesn't give them the exact same trusted access as any legitimate employee on the network.

And the timing couldn't be worse, because with economic pressure mounting, AI threatening jobs, and redundancies becoming more common, the temptation to make a quick payout by selling access to your employer's systems is only going to grow and most companies aren't built to catch it, especially when the person doing it is the one who's supposed to be setting the security culture in the first place.

Multi-factor authentication helps, but it's a bit of a band-aid when the person handing over the credentials is the CEO. At what point does this become something companies actually train for, or is "don't sell your login details" still somehow assumed to be common sense?

40% of ransomware attacks now come with physical threats to employees, and in the US that number jumps to 46%.

We're way past "pay up or we leak your data" at this point. A hospital got phone calls where strangers read nurses their home addresses down the line, and a security researcher had a threatening note left on his doorstep while he was actively helping a US government agency deal with an attack.

The playbook is simple and honestly kind of genius in a terrifying way, hackers stay hidden overseas and just hire local, post on a forum, offer some cash, and let someone else do the knocking. The FBI flagged a whole network for this last summer that's been tied to arson, kidnappings, even shootings.

What nobody seems to be talking about though is what this actually means for companies, because your HR database full of employee home addresses is no longer just a privacy liability - it's a physical safety problem, and I'd bet almost no incident response plan in existence covers the moment a staff member picks up the phone and a stranger calmly reads their address back to them.

If you work in security or IT, has this actually come up in any planning conversations at your company, or is everyone still treating this like a purely digital problem?