Date: 17 July 2024
With around 50% of UK businesses identifying a cybersecurity incident in the past 12 months, knowing what to do in the immediate aftermath of an attack is crucial. Cyber-attacks and data breaches are a pervasive threat and the most common type (84%) are phishing attempts. The average estimated cost of an attack is just under £10,800 for medium and large businesses.
But let’s not forget that cyber attacks are just one cause of cloud data breaches. These can happen due to employee errors, misconfigured settings, system failures, and third-party data sharing vulnerabilities.
Whatever the reason for the data breach, you need to know what to do so you can act fast. Building robust Cyber Incident Response capabilities is almost non-negotiable in the current threat landscape. In this article, we’ll cover the 6 immediate steps you need to take after there’s been a cloud data breach.
#1. Confirm the Data Breach
When you suspect there’s been a data breach, you must confirm its legitimacy. Cybercriminals trick people into sharing their data by using psychological tactics. Phishing emails are often used as a way to make you respond quickly.
Contact your IT department if you suspect data has been breached. They will help you to verify if it has occurred and provide information on what exactly has been breached. Avoid telling people about the breach until it is confirmed and has been properly assessed.
#2. Identify What Data Has Been Breached
With the breach confirmed, you’ll need to understand the extent of the breach. This is crucial for any business but especially for those that deal with sensitive customer information like financial records or personal details.
Call centres, for example, are especially vulnerable to data breaches. You may want to look into a call centre solution for your business and ensure that it has an extra set of built-in security. In cases where your call centre has been affected, identifying the specific data at risk is vital. Appropriate stakeholders need to be informed. This includes both IT staff, who will be able to help you fix any security issues, and legal advisors too. This allows you to ensure you fully assess the potential impact of the incident.
#3. Strengthen Account Security
Containing the data breach is crucial, and you need to act fast. Depending on what’s caused the breach, you’ll need to inform various teams. This might mean all staff need to create new passwords, for example.
Other key considerations are your third-party solutions. Many UK businesses have adopted remote desktop solutions like those offered by RealVNC to facilitate remote and hybrid working. For businesses using third-party solutions, you’ll need to ensure they’re securely configured and that only authorised personnel have access to them.
#4. Carry Out Legal Obligations
When you’ve confirmed the breach and identified the data involved, you’ll need to inform the relevant authorities. Organisations in the UL or those handling data of UK citizens are duty-bound by the GDPR to report data breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach.
If the breach has resulted in a high risk of adversely affecting individuals’ rights and freedoms, those people must also be told. New and upcoming regulations like the EU DORA have similar stringent requirements of data management and incident reporting.
#5. Prevent Future Data Breaches
Whenever a data breach occurs, it seems the perfect time to reassess vulnerabilities within the organisation and put together a plan of action. This might include scheduling regular vulnerability assessments, adding training sessions, and modifying incident response procedures based on the experience.
If your company relies on communication systems like an enterprise VoIP solution, you’ll also need to check these for their security to ensure their systems are as robust as possible. This is paramount to protect sensitive data across all communication channels of your business.
#6. Implement Custom Software Solutions for Data Security
After taking immediate steps to address a cloud data breach, it's crucial to focus on proactive measures to prevent such incidents from happening again. One effective approach is to invest in custom software solutions tailored to your organization's unique needs.
By investing in custom software solutions, you can strengthen your organization's ability to prevent future data breaches and better protect sensitive data across all communication channels. Custom software allows you to tailor your security measures to your unique needs, making it a powerful tool in the fight against data breaches.
Effective Ways to strengthen your data security
In the aftermath of a data breach, consider some best practices to strengthen your data security:
- Encryption: Implement end-to-end encryption for sensitive data. This means it won’t be ‘readable’ even if the data is compromised.
- Multi-Factor Authentication (MFA): Ensure that critical systems and sensitive data is protected by MFA. This might include a password as well as a one-time passcode sent to a trusted mobile device.
- Intrusion Detection Systems (IDS): Use IDS to monitor traffic on your network and notify you of any usual and suspicious activities.
- Security Audits: Carry out regular security audits and vulnerability assessments by testing systems for weaknesses.
- Employee training: Ensure all employees receive adequate training and regular refreshers on data security. By nature, people are often the weakest link. Training your key incident responders in NCSC Assured Cyber Incident Planning and Response training is a good way to mitigate damage arising out of a cloud data breach.
You’re Not Alone: Examples of Data Breaches in the UK
Data breaches are now a regular occurrence, as much as we hate to think about them. One of the biggest examples of a big UK company embroiled in a data breach was easyJet between October 2019 and March 2020. The data breach involved a staggering 9 million customer records and around 2,200 card details leaked.
Around the same time, Virgin Mega broadband had a data breach involving the personal data of some 900,000 customers. This data breach was the fault of a single employee who didn’t follow proper procedures when configuring a database.
More recently, the massive compromise of a third-party payroll system led to sensitive data of the UK Ministry of Defence being hacked. Data of 270,000 serving personnel, as well as reservists and veterans, from all three services was exposed.
One of the biggest-ever UK data breaches, however, dates back to 2018 when Dixons Carphone was attacked by hackers who gained access to 14 million personal records. This was achieved through the installation of malicious software on tills in a range of locations. More than 5,000 tills were affected. Incredibly, 5.6 million card details were stolen in the attack.
Final Thoughts
Data breaches, whether stemming from cyber attacks or other vulnerabilities, are a significant potential threat to any organisation. When a data breach does occur, it’s important to act quickly. A swift but calculated response is crucial. This can make the difference between limiting the breach and suffering further–and substantial–losses.
Adhering to a structured response is vital. And if a data breach reveals failings, these need to be addressed appropriately, too. Following the 6 immediate steps outlined in this article will help any business bolster its resilience to know how to deal with data breaches appropriately and prevent future problems.
