Slater & Gordon, one of Australia’s most recognised law firms, has found itself at the centre of a high-profile internal crisis, following the unauthorised circulation of an email that exposed confidential employee salary, performance, and personal data to the entire organisation.
The incident — now under police investigation – has sent ripples through both legal and HR circles. While many headlines have focused on the leaked salary figures and scathing employee assessments allegedly contained within the document, the situation raises more urgent and instructive questions for recruitment, human resources, and compliance professionals: How secure is your internal data? Who really has access? And what are the cultural conditions that allow this kind of breach to occur?
The Breach
On 21 February 2025, Slater & Gordon staff reportedly received a mass email containing an Excel spreadsheet with detailed information about the pay, rankings, and internal assessments of over 900 employees. The message appeared to come from the firm’s then-interim Chief People Officer but was later declared a hoax. A third-party forensic investigation reportedly concluded that a former employee with prior access to sensitive systems may have orchestrated the breach.
The metadata within the document pointed to the involvement of a previously dismissed staff member, raising questions around system offboarding, access controls, and legacy data management.
Workforce Implications
From a recruitment and HR perspective, the fallout is significant. Several staff were said to be distressed by the breach, particularly where unfiltered performance commentary was included — descriptions allegedly ranged from “lazy” to “needs to retire.” While the firm has since denounced the commentary and confirmed the data was inappropriately accessed and circulated, the damage to employee trust and psychological safety has likely already taken root.
The implications go far beyond PR. In a market where talent is mobile and retention is fragile, breaches of confidentiality can severely compromise employer brand and internal morale — not to mention the legal exposure under data protection legislation and workplace privacy frameworks.
The Broader HR Lessons
There are three clear takeaways for recruitment and HR leaders from this unfolding incident:
- Access Management Is Non-Negotiable
Offboarding protocols must include immediate and irreversible termination of system access, especially for those in HR, payroll, or IT roles. This event underscores the risks when sensitive information is not tightly controlled. - Cultural Integrity Is Just as Important as Cybersecurity
Even robust technical systems can’t protect against internal sabotage if organisational culture is strained or accountability structures are weak. Anonymous commentary, internal ranking systems, and opaque pay structures — if they exist — should be scrutinised for fairness and transparency. - Reputational Risk Is an HR Issue, Not Just a Legal One
Public perception of how an organisation values its people affects not only brand equity but also candidate attraction and internal engagement. The trust placed in an HR department is foundational — once lost, it’s extremely difficult to rebuild.
Moving Forward
Slater & Gordon have reportedly engaged law enforcement and cybersecurity professionals to investigate the breach. The firm has denied any wrongdoing by its current leadership and reaffirmed that no client data was compromised. Internally, it is understood that processes are being put in place to support affected staff and review protocols around pay transparency and performance management.
For HR professionals watching from the sidelines, this situation serves as a stark reminder: the systems you build — and how securely you manage them -are just as important as the people you hire. In an age of rising internal and external scrutiny, trust, compliance, and communication must remain at the centre of every workforce strategy.
