Nearly eight in ten former employees could still get into at least one work account or system after their last working day. For 64 per cent, this also included sensitive company information, such as customer data or financial systems. Handing back the laptop turns out to be no guarantee that accounts are actually closed.
The research was carried out by Sagiss, a managed IT and cybersecurity provider based in Dallas. In September 2026, the company used the research platform Pollfish to survey 1,000 American adults who had left a job in the past five years in which they worked with computers or company systems. The figures are based on self-reporting by the respondents.
Of those surveyed, 79 per cent say at least one account or access point continued to work after their last day. For 44 per cent, it was three or more. Thirty per cent say access remained active for longer than a month or still works, and 12 per cent believe their old access is still functioning today.
Email tops the list
Work email is most often overlooked: 33 per cent could still log in, and for 25 per cent email continued to sync with a phone or computer. A quarter still had access to shared files and 24 per cent were still receiving calendar invitations. The same proportion of former employees could still use a company AI tool. Respondents also mention business software such as CRM or payroll systems (19 per cent), the VPN (17 per cent) and the building access pass (17 per cent). Only 9 per cent report that nothing worked any more.
Notably, 62 per cent were strongly convinced on their last day that all accounts had been closed. Of that group, 78 per cent later discovered access that still worked.
Sensitive data within reach
In total, 64 per cent could still reach sensitive information after leaving. This includes customer data (29 per cent), financial records or payment systems (26 per cent), personnel files (22 per cent) and administrator accounts or shared passwords (17 per cent). In open-ended answers, respondents also mention patient records, student records and production environments in which they could still make changes. In addition, 71 per cent still keep company information somewhere of their own, mainly in personal email (32 per cent) or on a private computer (29 per cent). Sixteen per cent have company information stored in an AI tool or chat history.
Laptop returned, accounts open
Collecting equipment is the most frequently mentioned offboarding step, but only 28 per cent say their employer did this. Of that group, 82 per cent still had access afterwards. A third report that their employer carried out none of the steps listed. Ownership is also often unclear: 33 per cent do not know who was responsible for closing access. Only 4 per cent name an external IT service provider.
According to Travis Springer, president of Sagiss, companies focus mainly on the laptop because someone has to physically collect it. Accounts are less visible, and every application a team adds creates, according to Springer, an extra point of access that must be closed when someone leaves.
Reporting it helps only to a limited extent. Of the 41 per cent who alerted their former employer to the open access, 21 per cent saw it disappear the same day. For 31 per cent, the access still worked a week later. In addition, 47 per cent say they have used that access at some point after leaving.
Small organisations and temporary workers
At companies with fewer than 250 employees, 82 per cent of departed staff still had access, compared with 70 per cent at organisations with more than 1,000 employees. Companies with 10 to 49 employees score highest, at 86 per cent. For contracts that had ended and temporary roles, the figure rises to 89 per cent. Dismissals are not handled any faster either: for 59 per cent, access remained active after the termination meeting until at least later that day. Of those who used seven or more accounts, 87 per cent retained access.
Springer argues that offboarding works when one person manages the complete list of accounts and closes everything on the same day. According to him, many small businesses do not employ such a person. Sagiss recommends an up-to-date account list for each employee, a single owner for the process, closing access on the last day or when the dismissal is communicated, and changing shared passwords and door codes. The company itself offers services that carry out these tasks.
This article was originally published in Dutch on MSP Business. Read the original →
