IncidentSEV2INC-2031

A regional manager can see other regions' payroll

The West regional manager opened the Sales & Payroll model in Excel and saw salaries for every region. Contain it, find out why, fix it and prove it's fixed.

Reported by: Dana Whitfield, West Regional Sales Manager
Opened: Tue 14 Apr 2026, 08:31
Needed by: Containment within 4 hours
Priority: High
Time box: 4 h

Labels: hrpayrollurgent

Previously at Northwind

Sam built the Sales & Payroll model last quarter so regional managers could see sales and their own team's pay in one place. It was published as an app with an audience per region.

Why the business cares Salary data is personal data. A manager seeing other teams' pay is a privacy breach that Compliance may have to log, and it damages trust between managers and HR. Until it is contained, every day adds people who might have seen something they shouldn't.

Brief

Dana WhitfieldWest Regional Sales Manageremail Tue 14 Apr, 08:31

Payroll numbers?

Hi Elena, quick one. I opened the Sales & Payroll model in Excel this morning (Analyze in Excel) to build my own team summary and the pivot shows payroll for East and Central as well as West, names and all. I don't think I'm supposed to see that? In the app I only see West.

I haven't shared the file with anyone. Dana

Elena TorresBI Lead (your manager)chat Tue 14 Apr, 08:40

Treat this as SEV2 until we know more. Contain first, investigate second. Sam is on leave today, so it's yours. I've told Ava (Compliance); she will want a written timeline.

Don't delete anything: logs and the current model definition are evidence.

Ava MartinCompliance Officeremail Tue 14 Apr, 09:15

INC-2031: what I need

Hello. For my records I need: when the exposure started, who could have seen what, what was done to stop it and when, and how we know it is fixed. Please keep a timeline as you go.

Ava Martin, Compliance

What you are expected to do

Contain the exposure within the first hour, without breaking the app for everyone else. Record what you did and when.
Reproduce the problem with View as role (or by querying as the user) and capture the evidence.
Find every reason the security didn't hold. There may be more than one.
Fix the model so security is enforced by the engine, not by the report.
Build an RLS/OLS test matrix covering each role and a representative user, and run it.
Classify the severity, write the incident notes Ava asked for, and list preventive actions.

Deliverables

Containment action and timeline (what, who, when)
Root cause analysis: each weakness, with evidence
The corrected roles (TMDL or screenshots of Manage roles)
RLS/OLS test matrix: user, role, expected regions, forbidden regions, payroll visible?, expected total, actual, pass/fail
Notes for Compliance: exposure window, who could see what, how we know it's fixed

Evidence

roles.tmdl (from the published model) The model's security roles as currently deployed.
relationships.csv All relationships in the model, including cross-filter direction and whether they are active.
security_user_region.csv SecurityUserRegion table: which user may see which region.
employees.csv
payroll_q1_2026.csv FactPayroll: monthly gross pay and bonus per employee.
report_page_filters.csv Filters configured in the report (exported from the PBIR files).
activity_log.csv Activity events for the model and app since Monday.
App configuration