In May 2020, 8.8 BILLION data was leaked. Data and the controversies surrounding it has become a ubiquitous topic in status quo. From Facebook’s and Cambridge Analytica data scandal to researchers engaging in scientific misconduct by fabricating data to get favourable results, it is apparent that crises related to data misuse are prevalent. Yet, one of the possible crises are data breaches, which occur frequently and target all businesses, whether they are small or big. Although any crisis can be dealt with effectively-prepared management, data breaches are especially hard to deal with because of the technological aspects.
But How Do They Happen?
A data breach is a release of private consumer information that could happen both intentionally and unintentionally. While it could be that an internal source, such as an employee revealing the data of consumers, in most cases it is so-called ‘data-hackers’ that gain access to private data, such as email addresses, passwords, sometimes even credit card details. There are three primary reasons from the technological perspective on why data breaches are so recurring.
Firstly, it is due to the security systems that have not been updated, old and consequently unpatched. These lead to security problems, which are further compiled by information specialists into common vulnerabilities and expectations. Verizon’s Data Breach Investigation report has found that 99.9% of the exploited vulnerabilities have been compromised a year later after their announcement.
Secondly, it may be human error within the organization. For example, sharing account details, making weak passwords and falling for scams could all lead to data breaches. In fact, The UK Information Commissioner’s Office notes that 90% of UK cyber data breaches in 2019 were caused by human error.
Lastly, the occurrence of malware, an intentional software used to intrude and harm the computer system is used by hackers to acquire data. According to the aforementioned Verizon research, a malware event occurs every 5 seconds, and hackers try to modify the malware software in a way that is not recognisable to antivirus programmes.
These three reasons are exactly why data leaks are so common.
Covering The Tracks
The following issue comes up after the leak – how to trace the hackers? One of the things that makes finding the source so difficult is attribution. The attribution occurs when hackers change their address and the destination of the data file they are sending, making it seem like it’s coming from someplace it’s not. In addition, even if the company has an idea of the hacker’s Internet Protocol (IP) or the place the attack came from, it is incredibly hard to trace because all cybercriminals have constantly changing IP addresses by the use of Virtual Private Networks (VPN) and proxies.
What is more, it is difficult to trace them from a geographical standpoint. Because most data breaches happen by offenders from the USA, China and Russia, it means that the police cannot approach them in any way. If, for example, a company gets attacked, the police and legislators not only need authorization to interact with other countries’ jurisdiction, but also they need to make sure that extradition treaties are in place in case the hacker gets found. Yet, this is uncommon, which leaves many hackers unidentified.
Lastly, corporations do not make this process any easier, as they are very reluctant to report that they have been attacked. While this makes sense in the short-run, as companies care about sustaining their corporate reputation, it only digs a deeper hole in the long-run.
The Impacts of Data Breaches and Crisis Management
In my opinion, the best way to look at the impacts is through examples. For example, Uber’s data breach in 2017 potentially impacted 57 million, stealing their driver’s license numbers, email addresses, names and etc. The biggest, most recent case is the data leak of mortgage documents from the company First American Financial Corporation, which let anyone access bank account details, tax records, identification numbers of 885 million people. Usually, such enormous data files are sold on a data web, which can later be bought and exploited by criminals involving themselves in identity theft. The numbers are terrifying, so how can companies manage such an extensive crisis?
The timing of the response also remains important, as it would be best to act as quickly as possible.
Personally, the best approach to such a crisis would be accompanying the acceptance and accommodation strategies by fully apologizing and instrumenting a tactic of rectification, i.e, assuring that this will not happen again. The timing of the response also remains important, as it would be best to act as quickly as possible. A bad example of this is Uber, where they covered-up the aforementioned 2017 data breach for a year, additionally paying the hacker $100000 to delete the stolen data. This not only harmed the firm’s performance and their reputation, but they also had to pay $148 million for being responsible for the damage caused.
Despite these numbers, it does not mean that your data is going to be used all the time if you are a victim of data breach. You, the consumer, can prevent all the damages by making sure that all of your passwords are different, having an antivirus installed on your computer and not clicking on shady links. However, the possibility of a data leak needs to be discussed in a corporation and a good response should be thought of before it happens because the damage to the reputation could be irreversible and appalling.
Cover by: Ev
