What is a Data Breach?
Data Breach refers to any unauthorized modification, deletion, exfiltration or access to personally identifiable information (PII) within an organization’s information systems. PII includes any information that can identify an individual, including name, social security number, address, phone number and email. It also includes online activity, such as purchase history and browsing patterns.
The biggest risk to an individual is identity theft, which can lead to a permanent mark on their credit report and the potential for significant financial loss. Fortunately, there are things people can do to reduce their risk of harm.
Organisations are also at risk of data breaches due to weak security measures, such as unpatched software, password protection that is easy for cyberattackers to phish users with, and lack of encryption. While any organisation can suffer a breach, some industries are more vulnerable than others.
A notable example of this is the recent breach of 17 million Ecuadorian citizens’ personal data, which included official government ID numbers, family records, marriage dates and education histories.
If a data breach is identified, it’s essential to act quickly to minimise damage. This includes communicating with stakeholders, ensuring that appropriate access is restricted to apps and servers, preventing further damage, preserving evidence and investigating what happened. It’s also important to determine legal requirements, which can vary by state and territory. For example, in some states, there are laws that require a business to notify customers of a breach and provide them with help to protect themselves.