← All playbooks
Tier 5: Resignation Event

What do you do if you accidentally share confidential information?

The short answer

Report it immediately to your manager and your security or legal contact — within the hour, in writing. Do not attempt to delete, recall, or quietly contain it first. Regulated data breaches carry notification clocks measured in hours, and the only career-ending version of this is the one you tried to handle alone.

What's actually at stake

  • 01Concealment is the offence that gets people fired. The disclosure itself often does not.
  • 02Deletion attempts destroy evidence and make an accident look like intent.
  • 03Legal needs the raw timeline, not a tidied one.

Do

  • · Escalate to security/legal within the hour, in writing.
  • · Preserve everything exactly as it is.
  • · Write down your own timeline while it is fresh.

Don't

  • · Do not delete, recall, or edit anything.
  • · Do not warn the recipient off-record.
  • · Do not decide for yourself that it was 'not really confidential'.

A draft you can send now

Flagging a possible data exposure I caused. At 15:12 today I sent [document] containing [data type] to [recipient], who should not have access. I have not deleted or recalled anything and the original is intact. I'm available now to walk through the timeline and do whatever notification process requires.
Tailor this to my exact disaster →

Questions people actually ask

Can I just ask them to delete it?
No. Under most policies and regulations that is an unreported incident, which is a far worse position than the disclosure.
Will I be fired?
Accidental disclosures reported immediately are usually survivable. Concealed ones are usually not.

Take it further

Related incidents

All CYABot tools →