How to protect your business from data breaches

As the amount of data we interact with in our day to day life has grown in recent years, so too have the risks of a data breach.

What is a data breach?

When living and working online we often need to share our details with other organisations to access their services or buy goods and products from them.

A data breach occurs when information held by an organisation is stolen or accessed without authorisation. If any organisation you have shared your details with falls victim to a data breach, the information that you have shared with them may potentially fall into the hands of scammers and cyber criminals.

Criminals can then use this information when creating phishing messages (such as emails and texts) so that they appear legitimate. The message has been designed to make it sound like you’re being individually targeted, when in reality the criminals are sending out millions of these scam messages.

These techniques are known as ‘social engineering. Fraudsters exploit well-meaning staff members using knowledge about them that they have gathered from online sources. They use this information to convince them to reveal confidential information like passwords, to make a payment to the hacker, or simply to click on an attachment that contains malware such as ransomware.

Criminals may even send messages pretending to be from an organisation that has suffered a recent data breach.

Even if your details are not stolen in the data breach, the criminals will exploit high profile breaches (whilst they are still fresh in people’s minds) to try and trick people into clicking on scam messages.

Actions to take following a breach

If you’re a customer of an organisation that has suffered a data breach you should take the following actions.

Find out if you’ve been affected by contacting the organisation using their official website or social media channels.
Be alert to suspicious messages (if you think you may have already responded to a suspicious message, the NCSC have published guidance that can help you with this), which may be sent some time after the breach is made public. Remember, your bank (or any other official organisation) will never ask you to supply personal information.
If you receive a suspicious message that includes a password you’ve used in the past, don’t panic. If this is a password that you still use, you should change it as soon as you can wherever you have used it.
Check your online accounts to confirm there’s been no unauthorised activity. Things to look out for include:
- being unable to log into your accounts
- changes to your security settings
- messages or notifications sent from your account that you don’t recognise
- logins or attempted logins from strange locations or at unusual times.
If you suspect an account of yours has been accessed, refer to the NCSC guidance on recovering a hacked account.
To check if your details have appeared in any other public data breaches, there are a number of online tools that you can use, such as haveibeenpwned.com.

Useful Resources

The NCSC has published a range of resources to help keep you and your data safe.

For advice on creating strong passwords and staying safe online, visit www.cyberaware.gov.uk.

If you’ve received nuisance, suspicious or unwanted calls, please refer to this guidance from Ofcom.

You can get in touch with the NCSC by tweeting @NCSC or by contacting the enquiries team.