A data breach occurs when confidential, protected or personal data is viewed, copied, altered or disclosed without authorisation.
Under the GDPR, such a breach must usually be reported within 72 hours.
Types of Data Breaches
Data breaches do not only happen digitally, but also physically.
Physical Data Breach
Stolen laptops, lost USB sticks, improperly disposed files or documents left in the open are examples.
Encrypted drives and clear disposal rules prevent many of these cases.
Digital Data Breach
Attackers break into systems, databases are left unprotected online or emails go to the wrong recipients.
The amounts of data involved can be very large.
Causes of Data Breaches
Most breaches have either human or criminal causes.
Human Error
Wrong recipients, weak passwords, missing updates and misconfigured cloud storage expose data to unauthorised people.
Often a second check is simply missing.
Cyber Attacks
Phishing, malware, stolen credentials and automated password guessing by bots lead to break-ins.
Unprotected login pages are a common entry point.
Impacts of Data Breaches
Affected individuals and companies both bear the consequences.
Financial Impact
GDPR fines, damages, investigation and remediation cause high costs.
Lost business comes on top.
Reputational Impact
Customers move to providers they trust more.
Reports of a data breach stay in people’s minds for a long time.
Prevention of Data Breaches
Prevention is much cheaper than any remediation.
Implementing Robust Security Measures
Encryption, two-factor sign-in, need-to-know access rights, current systems and monitoring form the basis.
Bot protection such as CDPCaptcha on logins slows down mass testing of stolen passwords.
Employee Education and Training
Staff should recognise phishing, handle data safely and report incidents immediately.
Short, regular training works better than rare long sessions.
Response to Data Breaches
If it does happen, every hour counts.
Investigate the Breach
Establish which data is affected, how it happened and whether the leak is closed.
Document every step for authorities and insurers.
Notify Affected Parties
The competent data protection authority must be informed within 72 hours if there is a risk to individuals.
If the risk is high, the affected people must also be notified.
Conclusion
Data breaches can hit any organisation.
Prevention and a plan for emergencies keep damage and penalties low.