We experienced a serious bug at my organization that led to a data breach.

I work in the assessments department at a medical college and we provide endpoing assessments to our trainees in order to graduate and receive specialist status.

After each exam, we use mail merge from Microsoft word, plus the Adobe "generate a pdf" feature, to issue result letters to passing and failing candidates. There are different letters for passing candidates vs fail candidates.

If I were to just do this with Mail merge (without adobe) you are limited to opening the final dialogue box of one of the files at a time, so the information on the pass letter could never go to the failing cohort for example.

This stop gap does not exist when using the adobe tool, however, and unfortunately, if you have both dialogue boxes open at the same time, the letters for one cohort can be sent to the datasource associated with the second cohort. In our case, this lead to us sending the passing letters to the email addresses of the failing cohort.

Note that the letters themselves were correct and had all correct information, but sent to the wrong set of email addresses. This is a serious issue and should not be able to happen in the tool. There needs to be a way to either ensure that the dialoge box only pulls from the correct data source, or stop there from being two dialoge boxes in the first place (as MS does) so that this can't happen.

Best,