What is a Data Breach?
Data Breach refers to any situation where confidential, private or protected information is exposed to someone who is not authorised to access it. This could be the result of an intentional attack, an oversight or a flaw in your security posture. When personal information is lost or stolen, criminals can use it to steal your identity, damage your credit rating or ruin your financial standing.
Some of the biggest data breaches in recent years have involved organisations such as Equifax, Target and Yahoo. These breaches have damaged their brand reputation and made people associate them with the breach incident rather than their actual business activities. In some cases, people have switched to other products or services as a result of the breach.
Cybercriminals can also use the stolen logins from a data breach to hack into other sites in an automated process known as credential stuffing. If you reuse the same password on many sites, this makes it easy for criminals to gain access to your account and start to steal your money.
If your organisation suffers a data breach, you must notify the ICO unless you can demonstrate that there is no high risk to individuals’ rights and freedoms. You must also document the decision-making process, as this is an important record that shows how you have assessed whether or not it is necessary to inform affected individuals.