P2021-ND-336

The Organization uses a third party service provider, Dayforce. On or about May 27, 2021, a human resources employee was speaking to a former employee who, prior to their termination, worked in payroll administration for the Organization. During that conversation, the former employee made remarks suggesting they had (unauthorized) access to the Organization?s payroll information. The matter was escalated for investigation. In conjunction with Dayforce, the Organization determined ?that a Super Admin role had been established within ? payroll systems prior to the former employee’s departure, in a covert manner such that it was not easily detectable.? The Organization confirmed that records were downloaded by the former employee. The Organization believes the downloaded records were destroyed by the former employee; however, it had not received confirmation of destruction. Unauthorized access was possible between March 22, 2021 and May 28, 2021.