Data Breach
What is a data breach?
A data breach is an incident that causes the inadvertent compromise of confidential, proprietary, or otherwise sensitive data through its exposure or theft.
Accidental/Non-Malicious
- 1Unforeseen system glitches such as application failures, communication errors, accidental data dumps, etc., can cause the undue exposure of data.
- 2Human error such as replying all on an e-mail thread with sensitive information; accidental forwarding of communication to unintended recipients.
Compromised Password
- 1Weak passwords can be easily circumvented by savvy attackers utilizing password cracking applications. These malicious programs, once rooted in your system, continuously submit popular passwords and try simple variations in attempts to breach confidential accounts. Since usernames and e-mail addresses are commonly constructed using some portion of an individual’s legal first and last name, it is not difficult for cybercriminals who are targeting a specific person to guess basic credentials.
- 2Even strong passwords can be compromised if an attacker is able to leverage their access to existing accounts and effectively trigger some kind of password reset link that is sent to an account they control.
- 3Since large-scale data breaches are constantly taking place, it is possible that employee account credentials are already freely accessible on the web, unbeknownst to them. It only takes one breach of an application or service to expose usernames and passwords that have been used repeatedly across accounts. Additionally, attackers can often use even small pieces of information on a target to build convincing social engineering attacks (i.e. phishing).
System Exploitation
New vulnerabilities are discovered on a daily basis. They exist in all platforms and programs, no matter how trustworthy their manufacturer is. All systems, servers, applications and other business technology elements that are not updated in a timely manner pose potential security threats. Highly sophisticated hacking tools give criminals deep insight into company systems before they have even made a successful data breach.
Phishing Attacks
Phishing and other social engineering attacks remain the most effective way for attackers to breach otherwise protected systems. Cyber criminals have several options when seeking to penetrate an organization’s defensive capabilities. Often, social engineering attacks are a more efficient way for criminals to penetrate your system than trying to breach state-of-the-art technical protective mechanisms (that are still vulnerable to other forms of attack no matter their level of sophistication and implementation).
Third Party & Vendor Compromise
Data breaches of cloud services providers affect not only their immediate customers but also their customers' customers... By law, business owners are 100% responsible for the loss or damage of their customer data regardless of the third party or vendor they use to manage customer data and will be liable for security incidents that occur at these third parties.
Malware and SQL Injections
Other common methods of causing data breaches are SQL Injections and malware infections. They almost always occur via a public web-facing platform, visiting a compromised website, clicking on infected attachments and links, etc.
FINANCIAL
For all costs incurred by the incident, including record recovery, hardware replacement, technical support, government fines, law suits and much more.
OPERATIONAL
Downtime caused by being unable to resume normal activities.
REPUTATION
Even for large companies breaches are an embarrassing blight and cause an exponential drop in trust amongst customers. For smaller businesses data breaches can lead to bankruptcy as their already small client base can disappear completely
