I (22M) have been working at my present job for a little under 3 months. As a part of the onboarding process we had to give out identifying information as is typical for any job. I start and think nothing of how the onboarding information has been stored.

Fast forward to today and I come in for my usual shift and I see my friend on a different computer than he is usually on. After an exchange of pleasantries I ask him why he is on the other computer. He says that he is looking at his employee onboarding information. I walk over to the computer that he is sitting at and he shows me that they are storing employees onboarding information on the desktop of computers used for sales which with one miss click can display the employee's social security number, full address, full name, and date of birth. I click on my onboarding information to confirm this and there it is, everything about me is just right there able to be accessed by anyone who can click a mouse. They also have photo id's and school id's for members who have frozen their accounts because they go to school out of state, this information was just as accessible as the employee information. They also have this information on for former employees who have not worked for the company in the last 6 months.

I live in Illinois and I'm not sure if there is anything I can do about this or what to do. So I ask, is this illegal? If it is illegal, what steps should I take? Should I consult an attorney? Should I consult the labor board?

Any advice you can give would be greatly appreciated.