Unique employee # inadvertently sent out to distro of 100+ contractors

Imagine you work in an IT service desk role, you have access to reset passwords in AD and the email client the company uses + a multitude of other systems that include access to customer information.

This company doesn't have a least-privilege security in place for your specific department so you have access to reset passwords for users you shouldn't, just a "don't touch we monitor everything you do" policy.

One day, the payroll department inadvertently sends your employee # …

contractors cybersecurity distro employee