TLDR: A new report from HRD Canada highlights a growing crisis in HR data exposure, driven by excessive access to sensitive employee information and insufficient control measures. The report, published on August 7, 2025, reveals that HR data was involved in nearly 82% of over 1,200 data breach incidents, with recruitment data present in 58%. The rise of ‘shadow AI’ and a lack of stringent data minimization frameworks in North America are exacerbating these risks, urging HR leaders to implement stricter access controls and comprehensive training.
The landscape of human resources is grappling with an escalating crisis of data exposure, as detailed in a recent report by HRD Canada. Published on August 7, 2025, the article, authored by Lauren Johnson, underscores a critical imbalance: too much access to sensitive employee data coupled with inadequate control mechanisms.
HR data systems are repositories for highly sensitive personal details, encompassing everything from names, contact information, and social insurance numbers to banking data and comprehensive medical histories. This wealth of information makes HR databases prime targets for cybercriminals, a concern amplified by Julia Latacka, an instructor in HR Data Analytics and Technology at Concordia University. Latacka warns that the threat to data is intensifying, a sentiment supported by alarming statistics.
A recent review of 141 million files across more than 1,200 data breach incidents revealed that HR data was implicated in a staggering 82% of cases. Furthermore, recruitment-specific data, such as resumes and cover letters, was found to be present in 58% of these breaches, according to an analysis by Lab 1.
A significant contributing factor to this crisis is the explosive growth of ‘shadow AI.’ Organizations are increasingly concerned about employees utilizing generative AI tools like ChatGPT and Google Gemini through personal accounts, often inadvertently inputting sensitive company data. This unmonitored behavior creates major vulnerabilities, ranging from accidental leaks to outright data theft, as highlighted by Menlo Security.
Compounding the issue is North America’s less stringent approach to data minimization compared to regions like the European Union. Latacka emphasizes, “The general rule is that you should really only be collecting the data that you need. Whenever we are asking for HR data, it should really serve a purpose and then be deleted it when it no longer serves that purpose.” She further cautions about the legal and security implications of retaining unnecessary data: “You have to take into account legal requirements for deletion of data. Reducing the risk of keeping data that really doesn’t serve a purpose may cause greater issues if it were to be breached.”
The tension between data utility and liability is becoming sharper, particularly in the age of AI. To mitigate these risks, HR leaders are urged to implement robust measures, including restricting access to sensitive information, thoroughly auditing current data housing practices, and ensuring the security of all systems.
Also Read:
- Unsanctioned AI Tools Pose Significant Cybersecurity Threats to Enterprises, Studies Reveal
- Canadian Businesses Harness AI to Revolutionize Workforce Capabilities and Boost Productivity
Small and mid-sized companies are particularly vulnerable, often lacking the dedicated cybersecurity staffing, tools, and infrastructure necessary for adequate data protection. The human element also plays a critical role in breaches. Latacka points out, “Phishing emails, accessing links that aren’t safe, or putting information somewhere it shouldn’t be are all risks. A lot of organizations are still housing data on spreadsheets and SharePoint.” She advocates for HR departments to step up by providing targeted, frequent training and implementing proactive tests, such as simulated phishing emails, to bolster employee awareness and resilience against cyber threats.
