I worked for an outsourcing IT company, and one of the guys I work with filed invoices for the customer. The application he was using (SAP if I recall), also was used by payroll. At some point he got access to view quite a few peoples payroll records. He called the customers SAP support and they denied that he could possibly have access to those records. So he told them, well, why don't we ask some of the people in this list if this is what they make and see if it is accurate. They declined, and the records disappears shortly after. When he called them back about it, they were like we didn't do anything, you must have been mistaken about having access