Sensitive data security: why the products that store it are the new target
> TL;DR: Payroll software contains IBANs, salaries, social security numbers, ID documents. Why attackers target them and the flaws we find.
The hidden treasure in your product
When you think cyberattack targets, you think banks, hospitals, e-commerce. Payroll software is rarely mentioned. Yet it concentrates the most sensitive and most monetizable data in an organization.
For more — see our security audit for AI agents.
What your product contains
A single flaw in your product exposes all this data for every employee of every client company.
Why attackers target payroll
Market value: a complete employee record (IBAN + SSN + ID) sells for €50-€200 on dark markets. For your product with 10,000 employees, that's a haul worth €500,000-€2M.
Ransomware leverage: the threat of publishing an entire company's salaries is a powerful pressure lever.
Wire fraud: changing an employee's IBAN in your product = diverting their salary. Discreet and profitable.
The vulnerabilities we find
APIs without granular access control: a manager who accesses the API can retrieve data for ALL employees, not just those in their scope. Endpoints return complete objects (salary, IBAN, SSN) without role-based filtering.
Documents in public buckets: payslips, employment contracts, ID copies stored in S3 or Supabase Storage buckets without access policies. Accessible by direct URL.
Unrestricted CSV exports: export functionality that allows downloading all data in one click. No volume limits, no export logging, no managerial validation.
Unauthenticated payroll webhooks: payslip modifications, employee additions, IBAN changes via webhooks without signature verification.
The regulatory impact
Payroll data is personal data (GDPR). Health data (sick leave) is sensitive data under Article 9. A leak triggers the obligation to notify CNIL within 72h AND individual notification of each affected employee.
Our app expertise
We regularly audit software that handles sensitive data. Our external review identifies salary and sensitive data exposures without ever accessing the data itself. Report within 48h with GDPR implications and remediation plan.
For software vendors
CleanIssue specializes in security reviews for software handling sensitive data. If you're building a product, payroll tool, or ATS and want an external review of your exposure before a client audit or security questionnaire, see our offer for software vendors.
Key Takeaways
Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Go further
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Sensitive data: the simple flaws we find everywhere
Products that store sensitive data handle salaries, IBANs and ID documents. Here are the most frequent vulnerabilities.
The 5 most common flaws in products that store sensitive data
The exposure patterns most often found in products that store sensitive data: weak role separation, open exports, accessible documents, and overly chatty APIs.
Supply chain attacks on your dependencies: how they work and how to protect yourself
Supply chain attacks no longer target only large corporations. SaaS vendors that store sensitive data are prime targets. Here's a breakdown.
Sources
Editorial analysis based on official vendor, project, and regulator documentation.
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.