Have you fallen victim to a data breach?

Today our lives and businesses are increasingly run electronically, and online. In many ways this has improved our productivity, convenience, and of course accessibility. Unfortunately, accessibility can come with a price – vulnerability. Individuals, businesses and government departments are more frequently falling victim to data breaches; and this results in problems as diverse as identity theft, financial loss and intellectual property theft.

What is a data breach?

A data breach refers to any unauthorised access of information on a computer or network. In particular sensitive, protected or confidential data. Hacking is the most common example, however a data breach can occur through careless disposal of old computers, hard drives, bank statements or other confidential information, which may lead indirectly to a data breach.

Data breaches are unfortunately quite a common occurrence, affecting more aspects of your life than you may realise. Breaches may reveal your financial information, personal identification, health records, business trade secrets, confidential programs and employee information. For more information about breaches of intellectual property, click here.

One major concern about data breaches is that the security of your information is not always in your immediate control. The Ashley Madison dating site data breach that occurred in mid-2015 exposed the names, home addresses, email addresses, search history and credit card transaction records of past and present users. Hackers claimed the information through unauthorised access points on the website, and thanks to Ashley Madison’s policy of not deleting users’ personal information, the hackers had access to thousands of users’ details, which were then made public online.

How do data breaches occur?

The first and biggest mistake many business owners make is assuming their data is safe. Complacency is the primary problem for business operators who consider they are too small or unimportant to be targeted. The fact of the matter is if your network can be breached, it probably will be and when you consider the Ashley Madison example, reputational damage alone is probably reason enough to take preventative action.

Data breaches can emanate from external elements where highly skilled hackers penetrate weak points in your networks. This can involve cracking passwords, breaking through firewalls, and intercepting your computers, smartphones and other devices to gather sensitive information.

The other, surprisingly frequent yet often ignored source of data breaches is from within the company. Businesses of all sizes often consider their staff their biggest asset but they fail to see how improperly managing this valuable asset can lead to significant risks. Your staff members know your company better than anyone else, including where and how your intellectual property, records, personal details and other sensitive data is stored. Disgruntled employees can steal, leak or sell confidential information to competitors and this can be achieved without a trace if you are not properly prepared. It is also important to remember that your employees may aid in a data breach without knowing they are doing so. Hackers may send emails with embedded viruses, or even directly ask for information using social engineering tactics, gaining access all too easily.

In short, if you have data stored on a network or online, without proper protection you are at risk of a data breach.

How can you prevent a data breach?

Proactive measures for testing your system security are one of the best investments your business can make. Penetration testing is a service in which highly skilled IT experts conduct ethical hacking, testing the strength of your networks by legally attempting to break into them.

Penetration testing is done with the approval of the organisation being penetrated, however, usually the employees are left none the wiser. Keeping the testing a secret from your employees gives a more realistic representation of the strength of your security systems, and vulnerability of your employees. In other words, without awareness of a penetration test, your employees are less likely to be looking for one.

Aside from investing in penetration testing and network and human risk monitoring, keeping your security systems and employee knowledge up to date and in check is the first step you should take. Investing time and energy into creating secure passwords and firewalls, limiting employee access to highly confidential information, and managing your public online identity should be top priorities.

What should you do in the case of a suspected data breach?

Often the first response to a data breach is to attempt to shut down the vulnerability in your network. Even IT specialists and lawyers will recommend this course. While this may seem like the safest and fastest route to fixing the issue, it can sometimes be more detrimental than helpful. By shutting down the channel of access for external hackers, you are also possibly denying yourself crucial evidence, and therefore diminishing your chances of identifying the culprit.

This is why you should engage a private investigator in the case of a data breach

Spyware and hacking detection is only part of the picture. An experienced private investigator, in consultation with a forensic IT expert, will not only work to immediately secure your sensitive data but will concurrently endeavour to obtain evidence that will allow you to remedy the breach. Such a remedy may entail a criminal prosecution and / or a civil action against an ex-employee or external hacker. A private investigator will identify the risks and opportunities for gathering evidence, and even allow hackers to do something illegal in a controlled manner in order to have a stronger case against them. This is because your opportunities for gathering evidence may be limited and it is very important to grasp every opportunity you have to identify any untoward elements, especially if those elements are within your business.

If a competent investigator recognises that a client doesn’t have the evidence needed, he or she will ensure you have the best chance of gathering that evidence and achieving your objective. The investigator will be able to team you up with a good lawyer at the appropriate time, will ensure you are aware of what needs to be reported to police, and will report the final recommendations that should be taken into account by your IT team.

So what’s next?

Ensure your information is secure. Contact Lyonswood Investigators to talk about data breaches and how we can help you secure your information.