What is a Data Breach?
Data Breach is a term used to describe an incident in which unencrypted information or data is exposed to unauthorized users. This may occur through hacking, password theft, insider threats, and unpatched vulnerabilities.
It takes businesses 280 days on average to detect and contain data breaches, which can be costly to companies (IBM). A breach can affect millions of consumers in just one attack.
During the data breach, hackers can steal financial and personal information from the company. For example, they can gain access to bank account numbers and statements, mortgage records, photos of driver’s licenses, Social Security numbers, wire transfer receipts, and more. Ultimately, these stolen records can be used to commit fraud or identity theft against the victims.
The most commonly stolen record type is personally identifiable information (PII), followed by financial information. This information can be stolen through hacking, physical skimming of payment cards, or from portable drives and office computers that are lost or stolen.
If a breach exposes PII, it’s required by law to inform individuals that their data was compromised. However, it’s important to assess whether the risk of harm is high and what actions need to be taken to mitigate that. For example, a university breach that exposes alumni contact details is likely to result in a high risk of harm, so individuals must be informed. Similarly, if confidential medical records are compromised, it’s required to notify individuals. Also, if your website was involved in the breach and personal information was improperly posted, make sure that it’s removed. Internet search engines will often save these postings, so you’ll need to work with them to remove it.