Former staff still access data after leaving, survey finds

Sagiss has published survey findings showing that 64% of former employees could still access sensitive company information after leaving a job. The research was based on responses from 1,000 US adults who had left a role involving computers or company systems.

The Dallas-area IT and security services company said the results highlighted weaknesses in employee offboarding, with access to business systems often remaining active after a worker's final day. The issue affected access to customer data, financial records and human resources files.

According to the findings, 79% of respondents said at least one work account, system or access point continued to function after they left their employer. Another 30% said the access lasted for more than a month or was still active when they were surveyed.

The survey suggested these lapses were often linked to process failures rather than deliberate action by former staff. Most people who retained access said they discovered it without actively looking for it. The most common reasons for using the access were checking what was still available, retrieving personal files or completing a handover.

Offboarding gaps

One-third of respondents said their former employer had taken none of the standard offboarding steps, such as collecting equipment or explaining which accounts would be disabled. Another 33% said no individual or department had clearly owned the task of shutting off their access.

The report also found that collecting equipment did not necessarily mean digital access had ended. Among workers whose laptop, phone or other devices were recovered by their employer, 82% said at least one account or system still worked afterwards.

Workers who left smaller businesses appeared more likely to report lingering access. Among respondents who had worked at companies with fewer than 250 employees, 82% retained some access after leaving, compared with 70% of those who had worked at organisations with more than 1,000 employees.

The figures also pointed to risks around dismissals and layoffs. Among respondents who said they had been laid off or fired, 59% reported that their access was still working after they had been told their job was ending.

Security concern

The survey also examined what happened when former workers tried to alert companies to the problem. Of those who informed their previous employer that access remained active, 31% said it was still working more than a week later.

That delay raises questions about how quickly companies can respond when dormant accounts remain open. Sagiss said responsibility could be fragmented across HR, IT and line management, allowing access to remain open for weeks or months.

Sagiss commissioned Pollfish to conduct the survey in September 2026. Participants were US adults who had left a job in the previous five years in which they had used computers or company systems.

Travis Springer, President of Sagiss, said the issue often stems from a lack of visibility over the full range of accounts employees accumulate during their time with a business.

"Most companies treat offboarding as an HR checklist, but the real exposure is in every login a person picked up during their time there, many of which IT may not even know about. When no one owns that full list, access stays open by default. A forgotten account doesn't need a disgruntled former employee to become a problem, because attackers look for exactly those credentials, and most businesses won't know one has been used until the damage is done," Springer said.