Child Care Resource Center 9-Year Employee Data Leak: Insider Risk Detection and Remediation Guide

Child Care Resource Center (CCRC), a California-based organization serving families and child care providers, has disclosed a data breach with a staggering dwell time: employee personal data was exposed for approximately nine years before the organization discovered the leak. According to reporting by The HIPAA Journal, the incident illustrates how even well-intentioned employee practices — such as saving files to accessible locations for convenience or collaboration — can create persistent, silent exposure of sensitive data.

Nine years. Let that number sink in. This wasn't a sophisticated nation-state intrusion or a zero-day exploit chain. This was sensitive human resources data sitting in an accessible location for nearly a decade while the organization operated unaware. For defenders, this incident is a masterclass in the failure mode that matters most: the breach you don't know you have.

There is no CVE here, no vendor patch to deploy, no indicator of compromise to block. The remediation is architectural and procedural — and it applies to every organization handling employee PII, regardless of industry. Healthcare-adjacent organizations like CCRC face compounded exposure given their regulatory obligations under HIPAA-adjacent frameworks and California's breach notification statutes.

What Happened

Based on the disclosure, the key facts are:

• Organization: Child Care Resource Center (California)
• Data type: Employee personal information (HR/personnel data)
• Exposure duration: Approximately nine years
• Root cause: Well-intentioned employee data handling practices that left sensitive data in an accessible location
• Discovery: Recently identified during review, triggering breach notification obligations

This is the classic insider-adjacent data leak pattern: no malicious actor required. An employee places a spreadsheet of personnel data — names, Social Security numbers, dates of birth, payroll information — into a shared drive, a synced folder, or an improperly permissioned collaboration space. Access controls are either absent or overly broad. The file sits there. Years pass. Nobody audits the location. The data is technically "breached" the entire time, but nothing in the environment generates an alert because nothing anomalous technically occurred.

Technical Analysis: Why Nine-Year Dwell Times Happen

The Architectural Failure Modes

In my experience leading IR engagements, long-dwell data leaks almost always trace back to one or more of these conditions:

1. Overly permissive share permissions. A file server share or SharePoint/Teams site configured with Everyone:Read or domain-wide access groups. HR exports a report "temporarily" and never removes it.
2. Unmanaged shadow repositories. Employees sync sensitive files to personal or unsanctioned cloud storage (personal OneDrive, Dropbox, Google Drive) for remote access convenience.
3. No data discovery program. The organization has never run a systematic scan for PII patterns (SSNs, DOBs) across file shares, endpoints, and cloud storage.
4. No access logging or log retention. Even if the file was accessed inappropriately, there are no logs to prove it — or logs rotate after 30-90 days, erasing the forensic record.
5. Offboarding gaps. Departed employees retain access to repositories containing data they copied or created years earlier.

The Compliance Dimension

For organizations operating in California, this triggers obligations under the California Consumer Privacy Act (CCPA) as amended by CPRA, and California's breach notification law (Civ. Code § 1798.82), which requires notification when unencrypted personal information — including SSNs — is acquired by an unauthorized person. The nine-year exposure window creates significant legal complexity around determining when unauthorized acquisition occurred and the statute of limitations landscape. For HR data held by healthcare-adjacent organizations, HIPAA's Security Rule administrative safeguards (§ 164.308) — specifically risk analysis and information system activity review — are directly implicated even where the data itself is employee PII rather than PHI.

Exploitation Status

There is no indication of malicious exploitation in the CCRC disclosure — the leak appears to stem from internal handling practices. However, defenders should assume that any data accessible for nine years has been accessed, including by departed employees, compromised accounts, or anyone who traversed the share during that window. Treat the forensic question as unanswerable and the exposure as realized.

Detection & Response

Detecting this class of threat requires shifting from signature-based thinking to data-centric behavioral analytics: who is accessing sensitive data, in what volume, and from where. The detections below target the observable behaviors associated with both the creation of these leaks (mass copying of HR data, sync to unsanctioned cloud) and their exploitation (bulk access to personnel files).

Sigma Rules

---
title: Mass File Access to HR or Personnel Data Locations
id: 8f2c4a91-3b7e-4d5a-9c1e-6a8f2b3d4e5f
status: experimental
description: Detects a single account accessing an abnormal volume of files within directories commonly used to store HR, payroll, or personnel data. Nine-year leaks are often discovered only after bulk access occurs.
references:
  - https://attack.mitre.org/techniques/T1213/
  - https://www.hipaajournal.com/california-child-care-company-9-year-data-leak/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1213
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\\HR\\'
      - '\\Payroll\\'
      - '\\Personnel\\'
      - '\\Human Resources\\'
      - '\\Employee Records\\'
  selection_extensions:
    TargetFilename|endswith:
      - '.xlsx'
      - '.csv'
      - '.mdb'
      - '.accdb'
  condition: selection_paths and selection_extensions
falsepositives:
  - HR staff performing legitimate duties — baseline by user and alert on deviation from per-user 30-day average
  - Backup and DLP scanning service accounts — exclude known service accounts
level: medium
---
title: Sensitive Data Copied to Removable or Sync Folder Locations
id: 2b9d7e43-5c1a-4f8b-a6d2-9e4c7a1b8f3d
status: experimental
description: Detects files with HR/payroll naming patterns being written to removable media or consumer cloud sync folders, a common mechanism by which well-intentioned employees create long-dwell data leaks.
references:
  - https://attack.mitre.org/techniques/T1052/
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1052
  - attack.t1567.002
logsource:
  category: file_event
  product: windows
detection:
  selection_names:
    TargetFilename|contains:
      - 'employee'
      - 'payroll'
      - 'ssn'
      - 'personnel'
      - 'w2'
      - 'w-2'
      - 'roster'
  selection_dest:
    TargetFilename|contains:
      - '\\Dropbox\\'
      - '\\Google Drive\\'
      - '\\OneDrive\\'
      - '\\Box\\'
  selection_removable:
    TargetFilename|startswith:
      - 'D:\\'
      - 'E:\\'
      - 'F:\\'
  condition: selection_names and (selection_dest or selection_removable)
falsepositives:
  - Sanctioned corporate OneDrive for Business usage — tune to alert only on personal sync instances or unsanctioned providers
  - HR staff legitimately working with these filenames — pair with user context
level: high

KQL Hunt — Microsoft Sentinel / Defender

This query hunts for abnormal bulk read activity against HR-designated storage paths using Defender for Endpoint file events, and a second query identifies files with sensitive naming patterns landing in sync or removable locations.

// Hunt 1: Abnormal volume of file access against HR/personnel directories
// Baseline per-user access and flag outliers (>3x their own trailing average)
let HrPaths = dynamic(["HR", "Payroll", "Personnel", "Human Resources", "Employee Records"]);
let FileEvents = DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FolderPath has_any (HrPaths)
    | where FileName endswith_any (".xlsx", ".csv", ".accdb", ".mdb")
    | summarize DailyCount = count() by InitiatingProcessAccountName, bin(TimeGenerated, 1d);
let Baseline = FileEvents
    | where TimeGenerated < ago(1d)
    | summarize AvgDaily = avg(DailyCount) by InitiatingProcessAccountName;
FileEvents
| where TimeGenerated >= ago(1d)
| join kind=inner Baseline on InitiatingProcessAccountName
| where DailyCount > (AvgDaily * 3) and DailyCount > 50
| project TimeGenerated, InitiatingProcessAccountName, DailyCount, AvgDaily
| order by DailyCount desc;

// Hunt 2: Sensitive-named files written to sync folders or removable media
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("employee", "payroll", "ssn", "personnel", "roster", "w2", "w-2")
| where FolderPath has_any ("Dropbox", "Google Drive", "Box", "OneDrive")
    or FolderPath matches regex @"^[D-Z]:\\"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          FileName, FolderPath, SHA256
| order by TimeGenerated desc;

Velociraptor VQL — Endpoint Sweep for Sensitive Data at Rest

This artifact sweeps endpoints for files with HR-sensitive naming patterns in user-writable and sync locations — exactly the artifact class you'd want to find before it becomes a nine-year leak.

-- Hunt for HR/personnel data files sitting in user profiles,
-- sync folders, and other non-sanctioned locations
SELECT FullPath, Size, Mtime, Atime,
       basename(path=FullPath) AS FileName
FROM glob(globs=[
  'C:/Users/*/**/*employee*.xlsx',
  'C:/Users/*/**/*payroll*.csv',
  'C:/Users/*/**/*ssn*.*',
  'C:/Users/*/**/*personnel*.*',
  'C:/Users/*/**/*roster*.xlsx',
  'C:/Users/*/Dropbox/**/*.*',
  'C:/Users/*/Google Drive/**/*payroll*.*'
])
WHERE NOT FullPath =~ 'HR\\\\|Human Resources\\\\Sanctioned'
  AND Size > 1024
ORDER BY Mtime DESC

Remediation Script — Sensitive Data Discovery and Share Permission Audit

Run this against file servers and endpoint management infrastructure to (1) identify shares with dangerously broad permissions and (2) scan for probable SSN patterns in accessible locations.

# ============================================================================
# Long-Dwell Data Leak Remediation Toolkit
# Security Arsenal - Insider Risk / Data Discovery
# Run elevated against file servers. Review output before taking action.
# ============================================================================

# --- 1. Find SMB shares granted to Everyone / Domain Users ---
Write-Host "[*] Auditing SMB share permissions for overly broad access..." -ForegroundColor Cyan
Get-SmbShare | Where-Object { $_.Name -notmatch '^(ADMIN\$|C\$|IPC\$|print\$|NETLOGON|SYSVOL)$' } | ForEach-Object {
    $share = $_
    Get-SmbShareAccess -Name $share.Name | Where-Object {
        $_.AccountName -match 'Everyone|Domain Users|Authenticated Users'
    } | ForEach-Object {
        [PSCustomObject]@{
            ShareName    = $share.Name
            Path         = $share.Path
            Account      = $_.AccountName
            AccessRight  = $_.AccessRight
            Risk         = if ($_.AccessRight -match 'Full|Change') { 'HIGH' } else { 'MEDIUM' }
        }
    }
} | Export-Csv -Path ".\BroadSharePermissions_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

# --- 2. Scan accessible paths for probable SSN patterns (data discovery) ---
$ScanRoots = @("D:\Shares", "E:\Data")   # <-- Customize for your environment
$SsnPattern = '\b\d{3}-\d{2}-\d{4}\b'
$Results = @()

foreach ($root in $ScanRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.csv,*.txt,*.xlsx -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -lt 50MB } | ForEach-Object {
            try {
                $hits = Select-String -Path $_.FullName -Pattern $SsnPattern -ErrorAction Stop
                if ($hits.Count -gt 0) {
                    $Results += [PSCustomObject]@{
                        File      = $_.FullName
                        SSNHits   = $hits.Count
                        LastWrite = $_.LastWriteTime
                        SizeKB    = [math]::Round($_.Length/1KB, 1)
                    }
                }
            } catch { }
        }
    }
}
$Results | Sort-Object SSNHits -Descending |
    Export-Csv -Path ".\SensitiveDataDiscovery_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Write-Host "[+] Audit complete. Review the two CSV outputs and remediate:" -ForegroundColor Green
Write-Host "    - Remove 'Everyone'/'Domain Users' from shares containing HR data"
Write-Host "    - Move files with SSN hits into access-controlled, audited repositories"
Write-Host "    - Enable file access auditing (Object Access) on all sensitive shares"

Remediation

Immediate Actions (This Week)

1. Run data discovery now. If you have never scanned file shares, SharePoint, OneDrive, and endpoints for PII patterns, you are operating in the same blind spot CCRC was for nine years. Use the PowerShell script above, Microsoft Purview's Sensitive Information Types, or a commercial DSPM tool.
2. Audit share and site permissions. Enumerate every share and collaboration site with Everyone, Domain Users, or Authenticated Users access. Remediate to least-privilege security groups.
3. Enable access auditing on sensitive repositories. Turn on Object Access auditing for HR, payroll, and personnel data stores. Forward events to your SIEM. Without logs, you cannot answer the question regulators will ask: who accessed this data?

Short-Term (30–60 Days)

4. Deploy DLP policies covering egress to personal cloud storage, removable media, and personal email. Microsoft Purview DLP, or your existing CASB/SSE platform, can block or alert on SSN-patterned content leaving sanctioned locations.
5. Establish a data retention and disposal schedule. Data that no longer has a business purpose should not exist. Every year a stale HR export sits on a share is another year of breach exposure and notification scope.
6. Review offboarding controls. Verify that account disablement revokes access to all repositories, including SharePoint, synced folders, and any shadow IT the employee used.

Strategic (This Quarter)

7. Implement Data Security Posture Management (DSPM). Continuous discovery and classification beats point-in-time scans. Tools in this category (Microsoft Purview, or dedicated DSPM platforms) maintain a live inventory of where sensitive data lives and who can reach it.
8. Baseline behavioral analytics. UEBA capabilities in Microsoft Sentinel or your SIEM should alert on deviation-from-baseline access to sensitive data — the single most reliable detection for both malicious insiders and accidental exposure discovery.
9. Update your incident response plan for long-dwell discoveries. Your IR runbooks assume a breach started recently. Add a playbook for "discovered exposure of unknown duration": forensic scoping under uncertainty, notification decision trees, and counsel engagement for statute-of-limitations analysis.

The Hard Truth for Leadership

The CCRC incident did not require an attacker. It required only convenience, time, and the absence of auditing. Every CISO reading this should ask one question in their next staff meeting: "When did we last prove — with evidence — that sensitive employee and patient data exists only where we think it does?" If the answer is "never" or "I'm not sure," you are one well-intentioned employee away from your own nine-year headline.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub