Personal information about staff members was placed on an internal system accessible to all staff . There was insufficient logging to determine if anyone accessed the data . Information included employee name , SSN , direct deposit bank account numbers , administrative information about health insurance providers and other human resource data . ;