Ask HN: Ex-Employer gossiping I “hacked” their platform – what to do?
I ended up quiting about 2 months ago to focus on relaxing during the holidays and spending time with my family (did not take a vacation) before seeking a less intense position.
Some old members of my team have come forward to inform me that their was a set of data breaches on the platform and the internal answer was to not announce it and put the blame on me. From what I am told their is no prooof other then a geo location that points to where I (and multiple other employees) live.
I reached out to the CEO and basically the first question whas who was it to leak this and then basicly a statement that the company did not accuse me of anything and there is nothing that can be done about the gossip. When I left the company I took every precaution to revoke my credentials and return my equipment promptly. I now know I can not use anyone at my current employer as a reference and feel these false accusation will greatly damage my future employment opportunities. I am currently have meetings with attorneys on how to protect myself but figured I ask the community if anyone has ever gone though this.
98 comments
[ 9.1 ms ] story [ 374 ms ] thread...just don't use them as a reference? world is a big place.
As others in this thread have advised, hire a lawyer and discuss what your options are.
> Ha, yeah, I did no such thing, but they certainly want a scapegoat, don't they? So, when I was there, lemme tell you about their data security practices...
Gain empathy:
> Right, it's understandable that they'd want to blame somebody. And who better than me, walking out the door, going to spend more time with my family?
And minimize:
> But yeah, there's no real meat to their complaint. No attorneys or anything. They're just upset that they got caught shirking their legal responsibilities.
You might be able to hand-pick a reference from your old team, but you're right to not automatically volunteer your old manager's contact information.
I have to be good at telling stories like this. My first employer used legal strongarm tactics to disenfranchise me of thousands of commits of code, and my second employer tried to pin a sexual-harrassment claim on me and then fired me after I asked their head of HR to follow the law. Employers are dicks. Tell a story that lulls them to sleep.
Yikes. As a sibling comment notes, this is a red flag. It actually makes you sound guilty -- especially if you share details about weaknesses in your security. That alone might be criminal, depending on circumstances.
This a thousand times over. There are two options here:
1. Your employer wants a scapegoat and is using you
2. Your employer actually believes it was you
Good lawyers explain your options, risks and costs.
I have never been burnt, and I have spent very little money this way.
If there's talk going on inside the walls of a former employer that could jeopardize someone's career and future earnings potential, I think a consultation at minimum is prudent.
You could ask them formally to stop the slander and inform them that you will take legal action if you receive any more word of these rumours..
If it was a formal statement then you have nothing to worry about. If the slander is getting to you mentally, you could seek legal counsel but sounds like they can't actually do anything to you
If it was not formal, and there is a chance they can take you to court, then you need to get legal counsel, as you need to prep for defending yourself in court. If, as you say, they should not have anything which points to you being the malicious one here, then the hardest part is going to be the lawyer fees.
Very easy.
https://www.nolo.com/legal-encyclopedia/free-books/employee-...
This seems so vulnerable to data entry mistakes that such data might just be completely useless.
What happens when stated salary doesn't match salary verifier numbers? Do you just not hire that person?
Isn't that illegal in several states, including California?
I was terminated from my long time employer over what they called "poor performance" that was my boss compiling an actual "dossier" on me - everything from LJ posts from my ex-wife to WHOIS info to claim/show I was moonlighting (one, my photography business), a blog from a friend thanking me for giving him advice on a startup. Basically a hit list - he'd gone off the deep end on a few things, not just me, divorcing his wife, father dying, endless arguments with business partner / co-owner of the company.
He was adamant about a little sit down/FU session with me where he'd show me this damning dossier of all my "misdeeds".
Thankfully the partner got a lawyer involved who told them, in essence, "WTF? No.".
Apropos of both the state we were in being "at-will", and my employment contract / handbook having no provisions about moonlighting etc., the LJ posts being 10+ years old, etc., he basically said "As soon as you start showing this stuff it becomes somewhat defensible - he says 'actually, no, blah blah blah'."
"Just say that today is your last day. Thank you."
My boss was vindictive though. He wanted to contest my filing Unemployment paperwork about my "poor performance". He also wanted to withhold my final paychecks pending "return of all equipment, etc.".
I literally saw in a frozen screen glitch in Zoom the lawyer's response to him on that second one, verbatim.
"No. Do not do that. You cannot do that.".
Thankfully, for me, the partner and lawyer were the voices of reason, or it could have been difficult.
In terms of looking for a new job, more gray - I never stated that I was still at that job, nor did I let any question about it go unanswered or unclear (no lies by omission), other than just not specifically saying "I was terminated from job X on day Y".
It can actually be a good filter, prospect-wise: a company that does gossip about/blame an ex-employee for some of their failures is advertising their own lack of agency.
If they were smart, they wouldn't gossip, and not even let the gossip go. That's very bad strategy, both internally and externally.
If they're not, well, I can't tell you what to do.
What happened to me:
1. first I spent several horrible months expecting my whole career to be over;
2. until I realized my ex-employer and its own reputation in the field was totally irrelevant and could not harm much my reputation (or better yet, act as a useful filter);
3. when looking for employment, when relevant, I explicitly mentioned this experience and what came with it, and what I was then looking for in a new company/position/team, so that I was the first to pitch what did happen and how I reacted to it.
It served me well. Those that listened to my story and took the time to understand it turned out to be great teams to work with. Those that dismissed me on the spot, well... I can't say really - but what I heard of afterwise from ex-employees was kind of reminiscent. :)
It's always said not to mention negative situations with past employers. I've been through some shit along these lines in the past, but at times wish to be honest about what I seek in a place of employment to give comparing perspectives. How did you go about explaining this?
* Don't put your negative experiences on the fore front.
* But don't hide them either, because:
1. if you do hide them, they might always bite you in the neck later (personally, or professionally);
2. there's a lot to learn here as well, and that's what you need to take the focus on: what you learned from it.
If you can show that you confronted the negative experience, and solved/learned something out of it, you demonstrate a very valuable strengh to your potential employer: humility, courage, resolution.
Plus, that you prefer to bring potential bad news yourself.
That's worth mentioning.
As a hiring manager myself I really hate it when candidates slag off their current/former employeer. It's a real put off. However if you can turn a negative experience into a positive then it shows that you're not just bitter and/or a bad team player but rather that you use all experiences to help enhance your capabilities as a productive employee.
What's wrong with being bitter when you are wronged by your manager or employer?
"and/or bad team player"
Sounds like blaming a victim to me.
Seriously, imagine you got robbed, beaten and humiliated how would you feel listening to someone telling you that being bitter about that is bad and it's your own fault?
Being bitter about past employers is a sure fire way to fail an interview (from my personal experience) because a mopey employee is a poor performer, but it's also a lame way to go through life regardless.
Then maybe it shouldn't ask questions like 'why have you quit your previous job?' and focus on applicant's skills?
What I don't like is presumption that a conflict at previous job is an employee's fault.
Quite a long time ago, when I used to work for a local company, I did some hiring as a team lead and tried hard to avoid prejudice.
In a interview you’re trying to paint the best possible picture of yourself, anything that detracts from that is wasted effort. Why would y’all talk about your shitty previous employer when we can talk about something else that is interesting.
As a hiring type, I absolutely want to know why, in your words, you left. I also want to see how that lines up with what your references and what former HR people say, and possibly even compare that to something like Glassdoor reviews (if you're a strong candidate, mind you).
It is important. I want to see how they describe the situation they're leaving/left because it allows me to evaluate their ability to comprehend and communicate social/political/team dynamics. Statistically you're not staying with us longer than five (5) years, which means at some point you're going to have to explain why you left me -- and I don't feel like dealing with a shit talker.
Plus an honest, direct answer is different from being blunt. I need workers who are willing to tell me direct, honest truths sometimes.
I.E. "I never really clicked with the team, and found I was struggling personally and professionally to keep up with their changing demands,"
vs.
"They were elitist assholes who changed things on a whim because they thought they were fucking geniuses".
What I don't like is presumption that an applicant who gives the first kind of answer, is a bad team player and if he doesn't put the blame on himself he is 'bitter' (which is bad).
In the setting you've described I agree with you.
But a job interview is probably not the time or place.
Furthermore, there are often two sides to a story. It's entirely possible that I'll read your complaints as reflecting more about you than your current/former company.
More generally, raising gripes about teams/managers/work mostly don't use your interview time to raise positive aspects about yourself and your work even if they aren't necessarily negatives.
Example: "my last employer screwed me and it was an awful place to work." vs "my last job taught me a lot about the pros and cons of workplace culture, which is why I'm interested in your company now". They are both true statements, but one indicates the prospective employee is upset and holds grudges, while the other shows they are ready to move on to a better job.
Over time they can probably share more about why they left, but with the limited time in an interview it is best to show what they are focused on. Focus on old employer and anger doesn't sit well, while focus on a new potential job and lessons learned is very impressive.
The first answer in your example is honest, the second one, while technically true, triggers my bullshit detector.
#3 is really important. Do not shy away from sharing your stories with your potential new employer. It helps them better understand who you are. If they care about you and the investment they are making in you, then they will want to hire someone who is strong enough to stand up for something they believe.
Just keep your dirty laundry private would be my advice.
so, i struggle to see how hiding it is better from a game theory perspective. i do acknowledge that if your resume is strong enough as to "speak for itself", then not mentioning it is a reasonable enough gamble-- if they don't bring it up, and reject you anyway, then they are clearly idiots you don't want to work for anyway.
well, i guess I talked myself into a bit of a circle, but i guess i retain the claim that the prior of "hiding your baggage in all circumstances" is a bit more conservative than i think one needs to be.
We hired someone who came within a hair of (deservedly) being charged with a felony by the FBI. He basically said he did something stupid 10 years ago, had learned a lesson, made amends, etc. Had he not addressed it during the interview, we would definitely have not hired him when it later came up during a formal background check.
I think it's a tossup whether it should be mentioned in interviews because it can easily be misinterpreted/misread even by good employers to mean there's an issue with this applicant.
Was it a work-related alleged offense? If not, sounds a little extreme to not hire someone because of an allegation that happened 10 years ago that they weren't even charged with.
Essentially I did the same thing you did, reached out to the CEO, he denied they blamed me or my team and said there was nothing he could do about a few "bad apples" running their mouths. I disagreed and pointed out that what they say in a professional capacity about myself or my team as a result of our time there was something he can and should concern himself with. In the end, I did what everyone here is telling you, get a lawyer. It cost me ~$500 to protect our name and put an end to it, essentially we sent a cease and desist letter and a some wording on potential damages given our work and what was being said. That letter only got one response which was they had addressed the employees and agreed my team had nothing to do with their breach. That was all I wanted, and it is what you should get because if it ever comes up you can show that to whoever asks. Took less than a week to resolve and we did work for that company again like 2 years later, guess who no longer worked there, the "bad apples" were all gone, but most of the rest of the team was still around including the CEO who brought us back. So it didn't cause us any damage long term with anyone other than we probably pissed off a few people that were already running their mouths a bit.
One last point. I have had people bad mouth me for a number of things over my career. Not once did it ever really hurt me professionally, mainly because I had a track record showing none of what they said was true. As a consultant I had lots of people pissed saying we were there to displace them, replace them etc etc (even old developers saying that cause they had ancient skillsets). I had articles in a few papers how we were destroying jobs through automation of services of a long term employer in a small town. None of it hurt us, it hurt our pride/feelings a little cause we knew what they were saying was false, but in the end none of it ever affected us professionally. In some cases it actually helped us get other work partially because people saw we didn't react and get defensive or go off the deep end. I am not advocating you don't defend your professional reputation, but just realize there is a time and place to, and a time and place to just let it drop.
This is outrageous, and they are going to respond with "we took care of it" and that letter is now GOLD.
I also want to back up what the above poster said about being a consultant and folks badmouthing you. It is much less meaningful than you suspect or think, and in some cases it can be a good thing.
Talking to lawyers is the right thing to do. You don't want this gossip to become a legal issue for you. Collect detailed notes on when and where you turned in hardware, when / what credentials you had revoked, and to whom you delivered these things and informed about them. Just because you didn't perpetrate the hack doesn't mean that someone else wasn't using your hardware for something nefarious. I normally insist that a work laptop be wiped (obviously with all relevant work product handed off first) before i turn it in.
The truth is, it's in no one's best interest to drag this out. They'll do an investigation and only if they have solid evidence will anything come of it. In my case, I did nothing wrong and there was no evidence. Someone accused me of something I didn't do or coincidence(s) led to me being investigated (common in the area I work, actually).
Nothing came of it, because nothing happened on my end. However, it was a nerve-racking experience. Especially, because you never know if something is an accident or mistakenly evaluated.
In a case I'll share, we used a ruby on rails scaffold to create a web app. Unfortunately, it had a mailer in there and looked like we could send emails out. It wasn't active and all generic code "hello world", but you can see how people freaked out. Luckily, those investigating dug into the code and evaluated it, realizing nothing was connected.
In any case, if you did nothing, I'd put your odds at 99.9% chance nothing happens. In the 0.1% chance the company does something, they'll have the burden of proof and their customers will find out. Accusations do not prove guilt. The company would likely be more harmfully impacted than you will and you'll be able to provide a defense to the public record.
I would strongly urge you to retain counsel with a criminal defense attorney and seek to squash this as soon as possible.
When a company claims that someone, especially a former employee, is involved in criminal activity, they will point guns at you and ask questions later. In the eyes of law enforcement, you are presumed guilty.
1. Talk to lawyers, who will probably tell you to talk to no one and to refer LE/legal notices you get to them.
2. Never reach out to your old company about this. You probably should not have done this in the first place, since perversely asserting your innocence often makes you look more guilty (since 'that's exactly what a guilty person would do').
Basically, if this evolves into a legal matter it's out of your hands. Try not to get anxious about this, since rumors at an old company are entirely out of your control. If you're innocent, internal or external investigations should prove so.
I'll add-on that this should not have been an issue in the first place. The company should be protecting their customers better than this. It is already a failure of the process when employees are _maybe_ revoking their own creds on the way out. Not to mention what other issues actually led to the breach.
I'd also suspect a current employee (I feel sick even typing that out) before one that has moved on months ago.
To clear up a few things.
- The comments from the ceo were via text and more "I would of called you if i thought you did something" and "ill talk to them but I dont know what more I can do". TBH I was angry and not exactly cordial in my communication.
- From what I understand the "hack" wasn't my credentials but someone logging in near where I live with the CEO's credentials and changing some settings in the admin. This honestly is what scares me the most... everything in the admin is (or at least was while I was there) soft delete only with 5 minute interval database backups. The action has a potential to rune my life but the actual impact is basically a mild annoyance to the company... at this point I get concerned about sabotage.
- In terms of defamation apparently certain individuals though it be funny to take where I live and put it up on one of the system monitoring screens for the whole company to see. Currently I am seeking counsel to both protect my self and see if this action is something that is worth responding to.
Make sure you tell them that they should contact law enforcement to report the breach. If they don't want to do that that would be a pretty good sign they know exactly who did it and that it wasn't you. If they credibly believed it was you they would have done so already.
I mean the company already threw him under the bus, might as well transition from 'possible hacker' to 'whistleblower'. People tend to look more favorably on whistleblowers.
But IANAL, so YMMV and what not.
Edit: I'm betting the CEO would rather NOT be known for a data breach, and get that publicity. So it might be a good bartering place for getting a good 'written' recommendation, and some sort of assurance that the CEO if contacted will stick to what he said in the recommendation and not paint the ex-employee in a negative light. Not sure if there's a legal contract for this sort of exchange - but there probably is.
Your lawyer will probably want to handle all communication from here on out. I'd also stop posting stuff about the case in a public forum, and possibly start deleting this. Your lawyer will have specific recommendations.
The CEO should issue you an apology and they should make an internal announcement explicitly stating that you are not suspected of any wrongdoing, and that it is wrong to accuse you further.
If it is intentional, then why not say the company in the post?
In Europe this could be a violation of GDPR not to report it. If so, they would hurt themselves more by spreading this.
https://gdpr-info.eu/art-33-gdpr/
I wouldn't worry about it from that perspective. If you need to you can point out that the company hasn't spoken to the police even when you reached out to them with concern over it, or retained legal counsel, or etc...but chances are really good it's going to be a non-issue for future employment.
If they do eventually reach out to police, and assert it was you, it will be more interesting. That said, it doesn't sound like the kind of thing where they'd have a particularly compelling case.
Fighting back is a hassle, proving defamation is hard, getting lawyers is expensive, suing and the following process can take years. And the outcome? From an economic view, it's always a no, also the distraction from stuff that really matters, for what? Fighting is great, some like it a lot, but it costs so much energy. Moving on feels more sane. However, in the long run, there's always a bitter aftertaste, just an odd feeling that you lost a fight. This feeling will stay with yout for quite some time but it is often just in your head. Maybe the thing you are worrying about is not that big and not worth thinking one more sec about. You just don't know.
If there's a fool-proof way to fight + win something significant + in a short time frame, fight. Otherwise, get busy, get on new projects and once you are on a better position/in a new company you forgot them anyway.
So, asking us was a good first step to get a bit busy, get an achievement (getting on the front page) and out of racing thoughts. Now, keep on, write the next Ask HN about some tech, ask 10 peers for a coffee after new years eve, build a gaming pc, do whatever keeps you busy.
Edit: Not sure if you can trust the CEO but from what he wrote he sounds ok/friendly and he doesn't care (which is good, because if one of them would decide to sue you it would be him).