ADP is the payroll company I use for my small business of 17 years. I have used this payroll company for more than 5 years and after a normal payroll call in on Thursday, XX/XX/2018 I received my normal processing email of payroll complete. On Friday two out of 17 staff members direct deposit did not process in bank. Adp was phoned at XXXX and we were told all payroll was processed correctly for all staff and we should wait till XXXX for money to hit bank. Rep informed us that if by XXXX we dont receive missing payrolls call back and they would reverse payroll and issue manual checks. We phoned ADP at XXXX to have reversal done and while on ADP site to complete manual checknwoth rep on phone, we noticed another payroll was processed only a short time before we phoned for over {$18000.00} to three staff members?? Of course this was an error, but how is it that we noticed the error but didnt understand why or how this could happen without some type of security in place to red flag another payroll being done when payroll was already completed for the week and for an amount that is nearly twice our weekly payroll amount? After speaking with supervisor, I was told that the IT security department was researching the transaction and still looking for the two missing payrolls totaling over {$4000.00} that were still missing. After them not noticing the additional payroll we decided to do some further research and found that not only were two staff members bank account information changed on ADP website, but an additional staff member was changed so now three staff had been compromised and all their personal information was exposed as well as new bank account numbers were put so their payroll money would be rerouted to a green dot bank. How is it that I was able to find out this information in minutes without any technology and wasnt even notified from ADP? I immediately phoned ADP back and informed them of what I found and asked for a supervisor. He stated he was aware of my situation with the missing payroll but would transfer me to head security IT dept for further information. I asked him about the two payrolls that were rerouted due to their inability to secure the website and they said they were not responsible and then asked me if I had business insurance?? I asked why would I be out {$4000.00} because their IT security department is unable to secure the site properly. He then said the IT head security would explain everything, because my husband is an IT engineer, I had my husband speak with him and he was unable to tell us how it was done other than that banking information was changed on the XXXX and then again with additional staff member today. My husband asked about emails that are supposed to be sent regarding changes and he stated he was researching it still. When We asked him about the responsibility of ADP, he sAid the rep we spoke with in the Morning possibly overlooked all the changes that were made on the account but she should have asked when we questioned the missing payroll, he also said we should file a claim with my business insurance and file a police report. He even went as far as saying we needed to check the malware on our own computer. My husband explained to him the type of security measures in place on our computer and that unlike ADP, our systems our monitored closely and with such a large company as ADP, their IT department should be aware before anyone if their is a glitch in the system. My husband then asked what do we tell police?? ADP wasnt red flagged in the IT department when numerous changes and additional payrolls were made?? He said he would speak with officer but if we wanted IP address we would need to subpoena?? How is a payroll company of That magnitude not able to secure its website and client site to ensure that this doesnt happen again? Why should my company be out XXXX and almost XXXX if it wasnt for my staff catching it. Shouldnt ADP be held accountable? I pay for a payroll service every week and I cant even feel safe knowing my employees or I are safe in knowing our information on their site is kept secure?