A salary spreadsheet built for the comp committee goes out to the whole company through a misconfigured permission setting. It stays live for four hours. Pay gaps by gender and tenure are suddenly the topic of every Slack DM, and HR has to choose between addressing it and letting it settle. Rebecca Taylor put that scenario to Mhyrynde Noah, Director of Compliance & Benefits at Sojitz Corporation of America.
Mhyrynde split the problem in two before saying anything else. The leak created the crisis, she argued, but it did not create the perceived inequities. One half is a confidentiality breach with a cause to find. The other is a set of pay equity questions that were waiting long before anyone opened the file.
Why the First Hour Belongs to IT and Legal
Mhyrynde’s first calls go to IT and legal. If they do not know, she said, they should know “within the first 30 minutes.” IT needs to find the breakdown in permissions. Rebecca added that legal should be ready in case someone says their personal information was exposed.
She also wanted to know whether the accident was an accident. Someone received the file first, and that trail can be traced. A visible leak can also hide a bigger breach underneath it. Rebecca and Mhyrynde treated that as a live question, which is why the inquiry resembles an investigation that leaks from inside HR more than a routine IT ticket.
Employees came second only in sequence. “You can only do one thing first,” Mhyrynde said, and the employees would still be there. The first message to them went out soon after.
What the First Message Should Say
Mhyrynde kept the first message short. It acknowledges what happened and admits there are no answers yet. It says IT, legal, and HR are working on it, and it promises another update within 24 hours. A longer note invites people to read between the lines.
It also names the human side: the leak may have raised questions or emotions, and HR is available one on one once it has done the work. Rebecca pointed out that one or two sentences like that change how the whole message lands.
What the message leaves out matters as much. Mhyrynde warned against the one-liner many companies reach for: if you received this, delete it immediately. That approach “just throws fuel on the fire,” she said. People cannot unsee the numbers. She added that employees are legally allowed to discuss their pay. Section 7 of the National Labor Relations Act protects employees who engage in concerted activities for mutual aid or protection. A deletion order looks like an attempt to shut that down.
What Actually Works
Build the Pay Review Beyond Current Salaries
Mhyrynde does not treat a visible disparity as proof. A gap has to be tested against tenure and the compensation philosophy before anyone calls it inequity. For a gender wage gap, her review starts at hiring: starting pay, promotion timing, the size of increases, and whether women stall below the executive level or lose ground after caregiving breaks. The EEOC notes that under the Equal Pay Act, compared jobs need not be identical, only substantially equal.
Rebecca added performance history. If raises follow reviews, the reviews need checking for implicit bias in ratings. Mhyrynde also weighed running the analysis in-house against hiring an outside partner. Against the cost of a pay discrimination suit, she argued, outside help is the cheaper option.
Geography adds a third layer. Someone in Kentucky will earn less than someone in New York City for the same job. When gender, race, or disability are layered on top, as an intersectional lens on the workplace shows, the picture can look far worse. Mhyrynde flagged California, Oregon, and New York as places where these issues are heavily regulated.
Tie Tenure Gaps Back to the Pay Philosophy
The tenure gap is the one Mhyrynde expects almost any review to confirm. She sees employees hired last week earning more than colleagues with five or ten years at the company, because the veterans started lower and got minimal merit increases. That is classic pay compression, and a company may defer it to January to protect the year-end P&L.
Culture feeds it. Her company is Japanese owned and values tenure, and updating that philosophy for New York City and San Francisco is, in her words, a long and sometimes painful process. Her recommendation is a compensation review every year, not every three to five, with market benchmarking against peers until the job market settles.
Even pay that holds up on paper can feel unfair. Mhyrynde described people who say a $150,000 salary works out to about $137,000 once train fare and commuting time are counted. For people hired remote and now asked back, the return to the office comes straight off their pay. Rebecca made the related point that explaining the comp philosophy, and showing the work, makes those conversations more productive.
Set the Pace of Updates Before People Ask
That scope is why the work takes weeks, and the communications should say so. The pacing the conversation settled on: tell people up front whether the timeline is seven days, ten days, or two weeks, and do not send daily emails. Too many messages can also read as guilt, when the honest story is simpler: something went wrong, and the business is fixing it.
Where Employee Relations Fits
The leak may end as an IT fix. The concerns it surfaces do not. Some arrive as questions, some as formal complaints, and a few may become discrimination claims, so every one deserves a case record. Mhyrynde’s stated aim was to “make everybody whole,” and an inequity cannot be corrected without a record of what was found and why.
Pay concerns tend to multiply once one becomes visible, as in the retention mistake that became four raise demands. Running them through one place for pay investigations keeps findings, interviews, and corrections together.
Frequently Asked Questions About a Salary Data Leak
Call IT and legal. Mhyrynde Noah wants both informed within the first 30 minutes, so IT can trace the permission failure and legal can prepare for privacy concerns. A short acknowledgment to employees follows, promising an update within 24 hours.
It can ask, but Mhyrynde advises against it. Employees are legally allowed to discuss their pay, and a “please delete it immediately” message signals that HR wants the conversation shut down. People cannot unsee the figures.
Not on its own. Mhyrynde notes that a gap can reflect tenure or the compensation philosophy. The investigation looks at starting pay, promotion timing, raise history, and career interruptions before calling it inequity, and it may need an outside partner.
Every year, in Mhyrynde Noah’s view. The common guidance is every three to five years, but titles, market rates, and the job market have shifted enough that she recommends annual benchmarking until conditions stabilize.
Less often than instinct suggests. The episode recommends one acknowledgment, a follow-up within 24 hours, and then a stated timeline of a week or two for the investigation. Daily emails tend to look anxious rather than reassuring.
The Bottom Line for HR Leaders
Mhyrynde’s framing holds for any leak: the spreadsheet is a confidentiality problem, and the gaps inside it are a pay problem that predates the leak. Companies that answer only the first one end up answering the second in a complaint.
Her closing advice was about the HR leader, not the employees. When the frantic email lands, she advises against replying right away. Open a spreadsheet, break the work into a project plan, and step back with a coffee first. Ten minutes or half an hour, she said, will not make or break the outcome. “Give yourself that grace,” Mhyrynde said, and then “find some clarity and calm in the midst of it.”
See how AllVoices supports People teams that investigate pay concerns and document every correction.
