CYBCybersecurity

“I have nothing to hide”: why it is the riskiest phrase at work

A mailbox with “no secrets” still holds the trust of customers, colleagues and suppliers. Whoever breaks into it wants a credible voice, not confidences. We explain why, and which obligations stay with the company.

Strategic editorial team 11 February 2026 7 min read

Cover: ““I have nothing to hide” is the riskiest phrase”, Cybersecurity

Saying “I have nothing to hide” is risky because it confuses privacy with security. Anyone who uses a company account looks after more than their own data. They also hold the data of customers, colleagues and suppliers, and above all their trust. Whoever breaks into that mailbox is not looking for secrets. They want a credible voice to ask for payments, documents and access. So the right question at work is not “what do I have to hide?” but “how many people trust this account?”. And if personal data is breached, the duties to secure it and to report the breach fall on the company. In Italy they follow from the GDPR. In San Marino they follow from Law 171/2018, the country’s data protection law.

The barista’s dilemma

At the café downstairs from the office, on an ordinary morning, a company’s sales manager settles the matter over a coffee. “I’ve got nothing to hide anyway. If they want to read my email, let them.”

The barista dries a cup and answers without looking up. “Reading it, maybe not. But if someone uses that mailbox to tell your customers to pay into a different account, who loses out?”

Anyone who works behind a counter knows what trust is worth. They know which regulars can put a coffee on the tab and which cannot. Without realising it, the sales manager has just treated that trust as if it were worth nothing. That is not a personal failing. It is how almost everyone thinks about security until it happens to them.

What is the difference between privacy and security?

Privacy is about a person’s right not to expose what concerns them. Information security protects three different properties.

Confidentiality. Only the people who should see information can see it.
Integrity. No one can alter it without that being known.
Availability. It is there when it is needed.

“I have nothing to hide” speaks, at most, to the confidentiality of your own data. It says nothing about the other two properties. Above all, it says nothing about other people’s data.

An accountant may have nothing to hide about their own income. But they hold the income details of two hundred clients who rely on them. The same goes for a purchasing department, an HR team or a network of sales agents. Every mailbox holds someone else’s trust.

What does an attacker find in a mailbox with “no secrets”?

Everything needed for a convincing fraud.

The address book and the threads with customers and suppliers, with the right tone to copy.
Invoices, orders, bank details and due dates.
Signatures, logos and document templates.
Links to shared folders and cloud applications.
Password reset emails for other services, as in the story of the decorator and the reused password.
The calendar, which shows who is travelling, who is in a meeting and when no one will answer the phone.

None of these is a secret. Put together, they let a stranger speak in the company’s voice.

How is a breached mailbox used to deceive customers and suppliers?

With patience. The scheme is known as business email compromise, and it usually follows four steps.

The attacker gets in with a stolen password and reads for weeks without touching anything.
They create a rule that moves or hides replies from certain contacts, so they are not discovered.
They wait for a large invoice to fall due.
They write, from the real mailbox, that the bank details have changed.

The message passes every technical check because it comes from the right address. The authentication records described in When fax was safer protect against fake senders. They do not protect against real mailboxes that have fallen into the wrong hands.

FBI figures show the scale of the problem. In the 2025 annual report of the Internet Crime Complaint Center, business email compromise accounted for 24,768 complaints, with reported losses of more than 3 billion US dollars. The FBI notes that the scheme now also uses phone numbers and video-call platforms, not just email.

Who is responsible when customer data is breached?

The company is responsible, as the data controller. The attacker commits a crime, but that does not cancel the obligations of whoever held the data. The GDPR requires the controller to provide the following.

Technical and organisational measures appropriate to the risk (Articles 24 and 32).
Clear instructions to anyone who processes data under its authority (Article 29).
Notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people (Article 33).
A record of every breach, even when it does not have to be notified (Article 33(5)).
Communication to the people affected when the risk to them is high (Article 34).

In San Marino, Law 171 of 21 December 2018 follows the same structure. Article 33 covers the security of processing. Article 34 requires notification to the San Marino Data Protection Authority within seventy-two hours, where possible. Article 35 covers communication to the people concerned.

Then there is the damage no law can measure. A customer who paid into the wrong account will remember which address the request came from.

How do you change the question in practice?

Start with the accounts that other people trust most, and set proportionate measures for each one.

Account	Who trusts it	Minimum measures
Finance and treasury	Customers, suppliers, banks	Phishing-resistant second factor, no automatic forwarding to outside addresses, a phone check of every change of bank details
Management and their assistants	Staff, board, partners	Second factor, a record of delegated access, alerts on unusual sign-ins
Sales and customer service	Customers and agents	Second factor, training on payment requests, standard signatures and templates
Human resources	Employees and candidates	Second factor, restricted access to personnel folders, sensitive attachments encrypted

The same reasoning applies to artificial intelligence tools. Anyone who pastes a customer’s contract into a public service because “there’s nothing secret in it anyway” is making a decision on someone else’s behalf. Usage rules and approved tools are the subject of our page on AI security and governance.

In brief

“I have nothing to hide” is about your own data. At work, you mostly look after other people’s.
Security protects confidentiality, integrity and availability, not just secrets.
A breached mailbox lets someone speak in the company’s name, about invoices, bank details and urgent requests.
The data controller has duties of security, record-keeping and notification, in Italy and in San Marino.
The useful question is “who trusts this account?”. The answer decides the measures, account by account.

Frequently asked questions

If the attacker uses an employee’s mailbox, is the employee liable?

Towards the people whose data was exposed, and towards the supervisory authority, it is generally the company that answers, as the data controller. Internal matters, including any breach of company rules, are a separate issue. They should be assessed with HR and a lawyer.

Does a breached mailbox always have to be reported to the data protection authority?

Not always. Notification is needed when the breach involves personal data and poses a risk to people. The assessment has to be made straight away, because the deadline is 72 hours from discovery, where feasible. The breach must be recorded in any case, even when it is not notified.

How can you tell that a mailbox has been breached?

The most common signs are forwarding or filter rules that nobody remembers creating, and sign-ins from unusual places. Other signs include messages in the sent folder that the owner does not recognise, second-factor requests they never started and customers replying to emails nobody wrote.

Do San Marino businesses follow the same rules?

Law 171/2018 mirrors the structure of the GDPR on security, notification and communication to the people concerned. A business that offers goods or services to people in the European Union may also be subject to the GDPR, under its Article 3. It is worth checking this with a lawyer.

Bringing order to the most exposed accounts, the data protection rules and the breach procedures is part of the work of our Cybersecurity division, alongside your lawyer and data protection officer. Our simulations for staff and leadership are there to change the question before a customer asks it.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.