PanicStation.org
UK USA
uk Work & employment crises work calendar entries disappearing • outlook calendar events missing • work meetings vanished • calendar appointments deleted • shared calendar tampering • calendar invites cancelled • calendar entries removed • suspect colleague interference • possible it security incident • microsoft 365 calendar missing • exchange calendar changes • delegate access calendar • calendar permissions changed • workplace digital sabotage • meetings removed from diary • calendar audit trail • work schedule erased • unsure who changed calendar

What to do if…
you notice work calendar entries disappearing and you suspect interference

Short answer

Treat this as a workplace IT/security issue first: capture what you’re seeing, then report it through your employer’s IT/security process so logs and recoverable items can be preserved before anything changes further.

Do not do these things

  • Do not confront or accuse a colleague (or send an angry message). It can escalate and make fact-finding harder.
  • Do not “tidy up” by deleting more items, emptying Deleted Items, or reinstalling apps before IT looks at it.
  • Do not change sharing/delegate permissions or access settings unless IT/security instructs you to (and capture evidence first if you safely can).
  • Do not forward sensitive calendar content to your personal email or store it in personal cloud drives.
  • Do not post about it in team chats or speculate about motives/people.

What to do now

  1. Freeze the facts for yourself (2–5 minutes). Write down (a) which entries disappeared, (b) approximate dates/times, (c) which calendar(s) were affected (your own vs shared), and (d) which device(s)/app you noticed it on (desktop/mobile/web).
  2. Capture quick evidence without changing anything.
    • Take screenshots showing the missing entries (or gaps), the calendar name/account, and the date range you’re viewing.
    • If you can see update notices on invites (changed/cancelled), screenshot those.
    • Note the exact time you first noticed the change.
  3. Check for the simplest “not interference” causes (low-risk checks only).
    • Confirm you’re viewing the correct calendar and date range (and not a filtered view).
    • Check whether the entries are sitting in Deleted Items.
  4. If your organisation uses Outlook/Microsoft 365, note what’s recoverable (but don’t guess).
    • If you see an option like Recover Deleted Items, only use it after screenshots and only if you need urgent schedule continuity; write down exactly what you restored and when so IT can interpret logs correctly.
    • If you’re unsure, leave recovery to IT/admins.
  5. If you suspect account compromise, treat it as urgent.
    • If you’ve had unexpected sign-in prompts/MFA requests, password reset emails you didn’t initiate, or “new device” notifications, report that in the same ticket and follow IT/security instructions.
  6. Document access (without changing it yet).
    • If this is a shared calendar, note who has edit rights / delegate access.
    • If you can view calendar permissions, take a screenshot of the current permissions list.
  7. Report it promptly via your employer’s IT/security route (create a ticket).
    • Say you suspect calendar items are being deleted/changed and ask them to check audit logs and recoverable items for calendar changes/deletions.
    • Ask them to preserve relevant logs and recoverable items while they investigate.
  8. Tell your manager (briefly, factual, in writing).
    • One or two sentences: what’s missing, when you noticed, and your IT/security ticket number.
    • If this affects customers/patients/safety or key deadlines, state the operational risk.
  9. If it’s repeated or feels targeted, use the workplace people-process.
    • Keep a simple dated log (what disappeared, impact, ticket numbers, and any patterns).
    • If needed, raise a formal grievance using your employer’s grievance procedure.
    • For qualifying grievance meetings, there is a statutory right to be accompanied by a companion (typically a trade union representative/official or a fellow worker). Your employer may allow additional support, but don’t assume—ask.

What can wait

  • You do not need to work out who did it right now—focus on preserving evidence and getting IT to verify what happened.
  • You do not need to decide today whether to escalate formally beyond your first reports.
  • You do not need to rebuild your calendar immediately; recovery/audit checks should happen first.

Important reassurance

It’s common for calendar entries to disappear due to sync issues, accidental deletion, shared-calendar permissions, or automated policies. Documenting what you see and routing it through IT/security is a calm, protective first step that helps get to the truth.

Scope note

These are first steps to stabilise the situation, preserve the record, and trigger the right internal investigation path. Later decisions (formal grievance, data protection concerns, or wider reporting) depend on what IT/HR find.

Important note

This is general information, not legal advice. Workplace systems and rights can vary by contract and employer policy; if you feel at risk or are being treated unfairly, consider speaking with your union (if you have one) or getting independent advice.

Additional Resources
Support us