HR Insight

14 mins read

Why HR Data Is Different: Security That Actually Matches the Risk

Published: May 13, 2026

HR data security concept showing why HR data needs stronger protection in modern organizations

On June 20, 2024, a ransomware attack hit Indonesia’s National Data Center. This attack, utilizing the Brain Cipher variant of the LockBit 3.0 ransomware, disrupted critical government services for several days, including immigration processes at airports and online student registration. The attackers demanded eight million US dollars to restore access. The government refused to pay. A significant portion of the data stored in the data center was revealed to not have been backed up, leading to weeks-long recovery efforts and data loss.

The attackers didn’t target a defense system or critical infrastructure in the traditional sense. They targeted data. Specifically, the kind of data that governments and organizations accumulate about people: identities, records, employment histories, entitlements.

HR data.

This distinction matters. It reflects a broader shift in how attacks happen today — not through highly specialized infrastructure, but through systems that hold large amounts of structured, valuable information.

This incident was not an isolated case, nor is it specific to Indonesia. Similar patterns have appeared across multiple sectors and countries. Two years earlier, in 2022, Indonesia’s Central Bank was also attacked by ransomware without affecting its public services, and in 2021 a flaw in the health ministry’s COVID app exposed the personal data and health status of 1.3 million people. In 2023, the Philippine national health insurer suffered a breach that exposed sensitive records of tens of millions of members. A Thai media conglomerate lost both corporate and operational data in a ransomware attack. In the UK, payroll records for 270,000 military personnel were compromised in a single attack.

HR data security illustration showing the shift in cyberattacks from infrastructure systems to valuable employee data

Globally, the MGM Resorts ransomware attack cost the company eighty million dollars, much of the disruption centered on HR and payroll systems going offline

The pattern is consistent: HR systems are high-value targets. And most organizations are not protecting them accordingly. This is rarely due to negligence. More often, it is because HR systems have evolved operationally faster than the security models around them.

Why HR data is not like other enterprise data

Every organization handles sensitive data. Finance teams manage revenue figures. Legal teams hold privileged communications. IT teams maintain system credentials. But HR departments hold something different in character, not just sensitive in volume, but sensitive across multiple dimensions simultaneously.

Consider what a typical HRIS/HCM contains for a single employee: full legal name, national identity number, date of birth, home address, bank account details, salary history, performance records, medical leave history, emergency contacts, employment contract terms, and in many modern systems, biometric data used for attendance. In some organizations, it also includes disciplinary actions, and termination documentation.

No other enterprise system combines personal identity, financial information, behavioral records, and biometric data in a single place, for every person in the organization, maintained over years or decades. This concentration is not unusual. It is simply how HR systems are designed to function.

This concentration makes HR systems a natural primary target. A breach of the finance system might expose revenue figures. A breach of the HR system exposes every individual in the organization, past and present, as a person.

That data can be used for fraud, phishing, social engineering, extortion, and targeted attacks on individuals long after the breach itself has been contained.

HR data security framework showing why HR data is different by combining identity, financial, behavioral, medical, and biometric data

The implication is not that HR systems are inherently insecure, but that they require a different level of intentional protection.

It is also, increasingly, data that organizations are legally responsible for protecting — not as a best practice, but as a formal obligation.

What changed in 2024: UU PDP comes into force

Indonesia’s Law No. 27 of 2022 on Personal Data Protection (commonly referred to as UU PDP) came into full effect in 2024 after a two-year transition period. It is the most significant data privacy legislation in Indonesian history, and its implications for HR operations are direct and substantial.

The law establishes several obligations that HR leaders need to understand, not as legal abstractions but as operational requirements:

Data subjects (meaning your employees) have the right to access their personal data, request corrections, and in certain circumstances, request deletion.
They must give clear, documented consent before their data is collected or processed.
If a breach occurs, the organization must notify both the data protection authority and the affected individuals.
Personal data cannot be transferred outside Indonesia unless the receiving country meets comparable protection standards.

For HR software specifically, the law distinguishes between data controllers and data processors.

Data Controllers: Is the organization that determines how employee data is used.

Data Processors: Includes the HRIS vendors who handle the data on behalf of the
organization.

Both carry obligations. Choosing a vendor is not a delegation of responsibility. It is a shared accountability.

The UU PDP does not stand alone in the region. Singapore’s PDPA has been in place since 2012 and is among the most mature frameworks in Southeast Asia. The Philippines’ Data Privacy Act carries some of the region’s strictest breach notification requirements. Thailand and Malaysia have their own PDPA frameworks. Vietnam’s Decree 13 on personal data protection took effect in 2023. Organizations operating across multiple SEA markets, which is a common reality for companies in the region, are navigating a patchwork of overlapping obligations, each with its own specifics.

For most organizations, the challenge is not understanding each regulation individually, but operating consistently across all of them.

What this regulatory landscape means is that data privacy is no longer a compliance checkbox that legal handles once a year. It is an operational condition that HR, IT, and leadership need to manage continuously.

In practice, this means that decisions about data handling, access, and system design are no longer purely technical choices. They are part of how the organization operates day to day.

The CIA framework: a practical way to think about HR security

Security professionals often organize their thinking around three principles known as the CIA triad — not the intelligence agency, but Confidentiality, Integrity, and Availability (short CIA). These concepts are often presented as technical principles. In an HR context, they map directly onto everyday operational concerns.

HR data security CIA framework explaining confidentiality, integrity, and availability in HR systems

Confidentiality is about ensuring that employee data is only accessible to people who are authorized to see it. This sounds obvious, but in practice it requires deliberate design: role-based access controls that limit what each user can see and do, authentication systems that verify identity before granting access, and encryption that renders data unreadable even if it is intercepted or stolen.

Integrity is about ensuring that data is accurate and has not been tampered with. An HR system with compromised integrity is one where salary figures can be altered, attendance records can be manipulated, or termination dates can be changed — without detection. Audit trails and data change logs are the primary tools for maintaining integrity.

Availability is about ensuring the system is operational when people need it. A payroll system that goes down on pay day is not just an inconvenience; it is a breach of the organization’s obligations to employees. Backup systems, disaster recovery plans, and resilient infrastructure are what availability looks like in practice.

Most security gaps are not caused by a failure in all three areas.
They tend to appear when one is treated as less important than the others.

When an organization evaluates its HRIS security position, or evaluates the security position of a vendor, these three dimensions are the right starting point. Not a checklist of features. Not a list of acronyms.

A simple question: can we guarantee that our employee data is confidential, accurate, and accessible when it needs to be?

The human element is the most consistent vulnerability

The ransomware attack on Indonesia’s national data center was not caused by a flaw in advanced cryptographic theory. It was caused by compromised credentials: a vulnerability in how the system handled authentication, and a failure in the layers of protection that should have caught it early.

This pattern is not unusual. Research consistently shows that most data breaches involve a human element. This can encompass compromised passwords, phishing attacks that trick employees into revealing credentials, insiders who either deliberately or accidentally expose data, and failures in offboarding processes that leave former employees with active system access.

HR data security illustration showing how human element risks such as credentials and access can lead to employee data breaches

HR professionals are a specific target for phishing precisely because they manage communication with both internal and external parties. They receive CVs, correspondence, onboarding documents, and benefit claims from people they barely know. A malicious attachment disguised as a job application is a known attack device. So are fake emails from IT for password changes or a fake executive email requesting urgent payroll changes.

This does not mean the solution is purely technical. It means that effective security in an HR context is always a combination of system design and human behavior. One without the other is rarely sufficient. The technical side handles encryption, access management, firewalls, and the behavioral side means training, process discipline, and a culture where people know what to do when something looks suspicious.

What a serious security position looks like

There is a meaningful difference between an organization or vendor that talks about security and one that has invested in it at a structural level. The distinction is visible, if you know what to look for. These are not advanced practices. They are what tends to be present when security has been treated as an operational discipline rather than a technical feature.

Certifications are one signal.

ISO/IEC 27001 is an internationally recognized standard for information security management systems. Achieving it requires an external audit of security controls across the entire organization, not just the product.

SOC 2 Type 2 is a separate standard focused specifically on how service providers handle customer data, assessed over an operational period rather than a single point in time.

An organization that holds both certifications has been examined from multiple angles by independent auditors.

Penetration testing is another.

Responsible vendors commission external security firms to actively attempt to breach their systems and to test them for the vulnerabilities that real attackers would exploit. The results inform remediation. Periodic retesting confirms that new vulnerabilities introduced by system updates are caught and addressed.

Infrastructure decisions matter as much as application security.

Where data is physically hosted, whether there is a separate disaster recovery site, how frequently data is backed up, what the recovery time objective is if a system goes down- all these decisions are not technical details for IT teams to manage in isolation. They determine whether an organization can function if the worst happens

Policies matter too.

However, policies without enforcement are empty. An organization with a written data protection policy that has not been reviewed in three years, or a vendor whose security documentation is not available to customers on request, is not meaningfully different from a vendor with no policy at all.

The presence of these elements is less important than how consistently they are applied and maintained over time.

What this series covers

This is the first article in a series designed to give HR leaders, IT professionals, and executives who work with them a clear, practical understanding of data security as it applies to HR systems — specifically in the Southeast Asian context. Each article will cover one layer of the security question in enough depth to be genuinely useful, without requiring you to become a security professional in the process.

The articles that follow cover several key areas. These include how data is protected at rest, in transit, and in use; how access controls work and why layered authentication matters; what certifications like ISO 27001 and SOC 2 Type 2 actually test; the specific data privacy regulations across SEA markets and what they require in practice; the often-overlooked question of data anonymization and consent management; the organizational question of who is responsible for HR data security — HR, IT, or both; the infrastructure layer of hosting, backup, and disaster recovery; and finally, a practical guide to evaluating your HRIS vendor’s security positioning, including the questions that separate credible answers from marketing language.

The goal of this series is not to turn HR leaders into security specialists. It is to make the subject understandable enough to ask the right questions and recognize meaningful answers.

HR data security key takeaway showing how clarity, consistency, and understanding support better decisions and stronger data protection

After reading this series, you should be able to have an informed conversation with your IT team, ask your vendor the right questions, understand what their answers mean, and make decisions about HR data security that are grounded in reality rather than assumption.

That is what the stakes require.

A brief note on perspective: This series is written by DataOn, the team behind SunFish, an enterprise HRIS platform built and operated across Southeast Asia for over 25 years. We are a vendor in this market and want to make this clear before you decide how much weight to give to what we write.

What we bring to this topic is operational depth. We have designed, built, secured, and maintained HR systems for thousands of organizations across Indonesia, the Philippines, Singapore, Malaysia, Thailand, and Vietnam. The perspectives in this series come from that work: the issues we’ve seen customers navigate, the regulatory requirements we’ve had to meet in each market, the security investments we’ve made and why, and the questions HR leaders and IT directors ask us when they’re trying to make sense of a complex topic.

Where we describe our practices and standards, these reflect how we build and operate. We believe DataOn has a strong security practice for the region, and in several areas, goes beyond what is common among local and regional HR software providers. We say this not to position ourselves against competitors, but because understanding what serious security investment looks like is useful for anyone evaluating vendors in this space, including us. This perspective is not intended to be definitive. It is intended to be practical.

Please, use this series as a starting point for informed questions but still consult your own legal and IT advisors for compliance requirements specific to their situation.

Footnotes:

1. HR Handles Sensitive Employee Data

HR departments are responsible for managing sensitive data like personal information, financial details, and health records. According to IBM, data breaches involving personal data cost $150 per compromised record, making HR a significant target for cyber threats. IBM Cost of a Data Breach Report 2023.

2. Insider Threats Often Originate from HR Incidents

Insider threats, which can involve current or former employees, often originate from HR-related processes like onboarding and offboarding. The 2023 Verizon Data Breach Investigations Report noted that 74% of breaches involved the human element, including insider threats and errors. Verizon 2023 Data Breach Investigations Report.

3. Recruitment Fraud is Rising

Cybercriminals are increasingly targeting recruitment processes to carry out fraud. According to a report from the FBI, recruitment frauds caused over $58 million in losses in 2022, highlighting the importance of secure recruitment practices. FBI Internet Crime Report 2022.

4. HR is a Prime Phishing Target

HR professionals are frequently targeted by phishing attacks because they manage communication channels with both internal and external stakeholders. Proofpoint’s 2023 State of the Phish Report states that 86% of organizations experienced at least one successful phishing attack, often targeting HR. Proofpoint State of the Phish Report 2023.

5. HR Involvement in Cybersecurity Training Reduces Risks

Effective cybersecurity training can reduce the likelihood of human-related breaches. A study by Stanford University and Tessian found that 88% of data breaches are caused by human error, emphasizing the critical role HR plays in employee training and awareness. Stanford University & Tessian Report on Human Error.

Further Reading Materials: