Personnel data is information about employees and candidates, such as names, contact details, job titles, resumes, payroll details, and internal records. In cyber security, it is sensitive because it can be used to identify people, map an organization, or support fraud and social engineering.
Attackers target personnel data to build convincing phishing messages, impersonate recruiters or HR staff, reset accounts through baited helpdesk calls, or pressure victims in extortion schemes. Even partial records can help criminals tailor attacks to a specific office, role, or business unit. Defenders protect this data with access controls, encryption, logging, retention limits, and segregation of HR systems from broader networks. Monitoring for unusual downloads or mass exports can also reveal theft early, before the data is reused for targeting.