What happened?
In May 2023, the German newspaper Handelsblatt reported that it had obtained more than 23,000 internal Tesla documents, about 100 GB, which it called the "Tesla Files". According to reports, the dataset included customers' bank details, production secrets and customer complaints about the autopilot feature.
In August 2023, in a data breach notice sent to the Maine Attorney General (USA), Tesla said two former employees had "misappropriated" the information and shared it with the media. The personal information of 75,735 current and former employees was affected, including names, addresses, phone numbers, employment-related records and Social Security numbers. Tesla said it had sued the two individuals, leading to the seizure of electronic devices and a court order barring them from continuing to use, access or distribute the data.
Why is this lesson worth noting?
- Insiders already hold legitimate access. Firewalls and anti-malware software cannot detect someone using their own rights to take data.
- The data belongs to several different groups. The same incident involved employees' personal data, customer information and production secrets.
- The consequences last after the employee leaves. Closing the account only affects data still inside the system; copies already taken outside are no longer under control.
Lessons for enterprises
- Determine who actually needs access to which data and limit by role, instead of granting broad rights to whole teams.
- Record access and file-copy logs so that when an incident occurs you know who opened, copied or sent which document, and when.
- Have a rights-revocation process when staff leave, including documents already stored on personal or mobile devices.
A data-centric approach
When documents are protected on the file itself, the right to open and use a file is tied to the user, device and the policy granted, not only to where the file happens to sit. Enterprises can revoke rights when staff leave and use audit logs to trace activity. This approach helps reduce risk but does not replace HR processes, confidentiality agreements and access-rights governance. See also the product.
Three questions for a self-check
- When an employee leaves, do you know which documents they opened or copied in their last 30 days?
- Do documents containing employees' personal data have separate permissions from ordinary documents?
- Do documents taken out of the system remain under usage-rights control?
