The Nine Year Vacation

9.

That’s how many years a California child care company let employee data leak. Not nine months. Not nine weeks. Nine years.

If you've been in this game since the early SOX days like I have, you know exactly what this is. It isn't a "security incident" or a "sophisticated breach." It’s a total absence of detective controls. You can't call your security posture effective if it takes nearly a decade to notice the back door has been wide open.

I remember the 2003 gold rush when firms treated their control matrices like religious texts: sacred, untouched and completely imaginary. They’d check a box saying "Quarterly Access Review Performed" while the actual review was happening in some manager's daydream. This is that same theatre, just played out with personal data instead of spreadsheets.

The design flaw here is embarrassing. A basic access log review or a simple automated alert on anomalous data egress would have caught this in weeks. Instead, the company relied on a "silent" system that only spoke up once it was too late.

What does this cost you at year-end? For the child care firm, the bill isn't just the potential fine from the State AG or HHS OCR. It’s the forensic archaeology project they now have to fund. When you have nine years of baggage to unpack, you aren't paying for a quick scan; you're paying specialists to sift through a decade of digital debris to figure out who actually saw what.

The common defense in these cases is that the leak was "passive" or the data wasn't "highly sensitive." That’s a loser's argument. A control isn't there to stop a thief who knows exactly where the vault is; it's there to tell you when the vault has been missing for three thousand days.

Look at N-able this week. They just flagged a material weakness in their revenue controls, leading PwC to issue an adverse opinion. That’s the corporate equivalent of a failing grade on a report card. Whether it's revenue recognition or employee data, the root cause is always the same: people prefer the appearance of control over the actual work of designing one.

The second-order effect here is where it gets interesting. I want to know who audited this child care company. If an external consultant or auditor signed off on their compliance for a fraction of that nine-year window, that auditor's reputation is now radioactive. When a regulator sees a gap that wide, they stop asking "How did the company miss this?" and start asking "Who told the company they were doing it right?"

The insurers will be next. Underwriters hate gaps they can't quantify. A nine-year blind spot suggests a systemic failure of governance, which usually means the premiums are about to spike for every similar mid-sized firm in that sector.

Some might argue that smaller firms can't afford continuous monitoring tools. That’s nonsense. You don't need an expensive suite of software to notice your data is leaking; you just need a process that actually happens. Control theatre is free until the regulator shows up. Then it becomes the most expensive mistake you ever made.

I'll believe they've fixed their "process" when I see a timestamped log showing someone actually checked the permissions last Tuesday.