The diverse amount of personally identifiable information that may be compromised when employee email accounts are hacked should force in-house counsel to reconsider policies and procedures surrounding email use, according to experts in the wake of a recent T-Mobile USA Inc. data breach.

Over the weekend, Bellevue, Washington-based T-Mobile, a month before it is expected to merge with Sprint Corp., announced on its website that an attack on one of its email vendors allowed hackers to gain access to "certain T-Mobile employee email accounts." T-Mobile was able to determine that the email addresses compromised contained customer names, addresses, phone numbers, account numbers, rate plans and billing information. The company said in its notice that credit card and Social Security information was not compromised. It is not clear how many customers were impacted or how many email addresses the hackers had access to.

Brian Kint, a member at Cozen O'Connor in Philadelphia, said there is a variety of information that hackers can access through email addresses and it is difficult to track, unlike other cyber breaches.

"When a hack compromises a database, it is clear what kind of information was in there," Kint said. "There can be personal information in that email that you do not know about until you go into the actual email boxes."

Phyllis Sumner, a partner at King & Spalding in Atlanta, said a hack like T-Mobile's should serve as a reminder for in-house counsel to review their policies and procedures regarding what information can and cannot go into an email.

"That may help reduce the risk to organizations," Sumner said. "Employees should never include personally identifiable information or other sensitive data in emails."

One issue that in-house counsel should consider when reviewing policies and procedures surrounding business emails is how that will impact the business. Sumner said drastic changes to company policies and procedures could impact how employees conduct business.

Tracking the Data

While T-Mobile appears to know which data has been compromised, that answer is not always clear. In-house counsel will likely need to hire an outside cyber forensic firm, under privilege, and comb through employee emails.

Kint said most companies have a policy statement in reference to cyberattacks and that in the U.S. an employee email address is regarded as the property of the employer.

"The first step is to put the notice out there that employee emails have been compromised," Kint said. "You don't want them finding out through a news story or through a letter in their mailbox."

Sumner said that notice is also important to distribute in case in-house counsel needs to search through personal devices that employees use for work.

"Organizations need to think about company culture, how they manage their employees and balance that with keeping the investigation confidential and privileged," Sumner said.