What is a data breach?
A data breach is a cyber security incident where someone intentionally or unintentionally leaks an organization’s sensitive information.
Data breaches can happen in any-sized business and often involve confidential data like a company’s intellectual property, trade secrets or customers’ personally identifiable information (PII).
While it’s common to associate data breaches with hackers, 1 in 3 breaches occur due to insiders , and 78% are unintended. Understanding how data breaches happen can help you teach employees and other internal stakeholders how to secure data.
How does a data breach happen?
Data breaches occur due to insider threats — i.e., individuals with authorized access to a company’s systems — and external factors like cyber attackers.
Here are a few typical ways data breaches occur:
- Malicious insiders: Employees or other insiders may use their privileged access to take or leak company data for personal gain, revenge or other negative reasons.
- Accidental exposure: Not all insider threats are malicious. Employees may unknowingly share information with the wrong parties or expose data through error while trying to operate more efficiently.
- Lost or stolen credentials or equipment: Unfortunately, creating strong, complex passwords may not be a priority for all employees. And if someone loses a company device locked by a simple password, bad actors can crack and gain access to company information.
- Social engineering attacks: Cyber attackers can pose as other employees or vendors and ask employees for information via text or email. In this form of social engineering, called phishing, attackers create a sense of urgency and fear that prompts victims to reveal sensitive information.
- Malware infections: Some external threats aim to infect company networks or databases with malware to give them unauthorized access to confidential information. Severe incidents might enable point-of-sale (POS) attacks and card skimming, which provide attackers with transaction and payment data.
- Lack of encryption: Without encryption — the process of concealing information by altering it to appear as random data — an unauthorized person could access a company’s data.
In recent years, workforce volatility due to frequent job changes, layoffs and hiring freezes has made these threats even more pronounced, so it’s essential for companies to stay vigilant.
What Can Attackers Do With Stolen Data?
When attackers obtain sensitive information, they can use it for financial gain, identity theft, or to compromise an organization’s systems. High-value data, such as corporate records, account credentials, or personally identifiable information (PII), is often sold on criminal marketplaces or used directly to commit fraud.
For organizations, stolen data can expose financial information, intellectual property, internal communications, or regulated records. This can trigger operational disruption, regulatory penalties, and long-term reputational harm. Government and critical infrastructure breaches can also reveal sensitive national security information that adversaries may exploit.
For individuals, the risks include identity theft, unauthorized financial activity, takeover of online accounts, and the creation of synthetic identities using stolen PII. These impacts can persist for years after the initial breach.
In the Equifax breach, for example, attackers accessed the Social Security numbers, birth dates, and financial data of 147 million people, creating widespread identity theft risks and leading to one of the largest settlement actions in FTC history. This security breach highlighted how a single vulnerability can expose entire populations.
Data breach laws
The U.S. and other countries have enacted laws to protect companies and individuals from the negative impact of data breaches. Laws vary from country to country, and in the U.S., from state to state:
- The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). This U.S. federal legislation requires companies to report cybersecurity incidents within 72 hours and ransom payments within 24 hours. Quickly reporting data breaches can help identify and stop perpetrators faster.
- The California Consumer Privacy Act (CCPA). CCPA is California state legislation from 2018 that gives consumers more control over their data. Under CCPA, consumers have the right to know what personal information businesses collect and how they intend to use it. Californians also have the right to delete personal information and disallow companies from selling it.
- General Data Protection Regulation (GDPR). The EU enacted GDPR in 2018 to protect the European Union’s citizens’ personal data. GDPR consists of seven principles related to transparency, limitation, accuracy, confidentiality and accountability. Keeping customers’ identities private decreases the adverse effects of a data breach.
- CPS 234. In 2019, Australia passed CPS 234 to minimize the impact of security incidents. Under CPS 234, companies must adjust their security capabilities to be “commensurate with the evolving size and extent of the threats to their assets.” CPS 234 has forced organizations to institute information security frameworks and implement a security governance model.
Laws and regulations can help reduce data risk, but there are other tactics companies can do to lower their chances of a data incident breach and mitigate them if they happen.
How to prevent data breaches
To help your organization secure data and avoid a data breach, security teams can implement these best practices:
- Educate employees proactively on data security. Instead of an extended video module plan that staff potentially write off as a yearly “checklist item,” offer employees an interactive program that helps them recognize their risky data behavior.
- Stay updated on application security and patching. Security administrators can regularly patch and upgrade software to verify that their company isn’t running any compromised code. Routine software library audits can also help minimize the chance of your team missing an employee using an old software package.
- Identify vulnerabilities and address threats in your network. Proactively finding and fixing weak points in your network can prevent threats from becoming data leaks.
- Use multi-factor authentication (MFA). MFA is a second layer of protection when someone tries to access company data. It requires a user to know their password and verify their identity with either additional information, something they own like a smartphone or have inherently like a thumbprint.
- Create a response plan. If a data breach occurs, you can avoid confusion by being ready with important contacts, disclosure strategies and mitigation steps. Ensure that your employees know this plan for proper mobilization before a breach occurs.
- Implement security software that monitors data movements to untrusted locations. It’s impossible for a security team to have visibility into all data loss events with traditional security software. Protecting data demands software that monitors all data movements and prioritizes alerts to security based on risky user behavior.
Having a plan and abiding by general security hygiene is excellent, but organizations need a new way to protect their data from breaches. That’s where comprehensive data protection software can help.
Data breach prevention with Mimecast
Mimecast Content Control and Data Leak Prevention is a cloud-based service that delivers organization-wide data breach prevention through seamless integration with Microsoft Exchange. Guarding against both inadvertent loss and malicious attacks, Mimecast’s service provides centralized management and real-time application of flexible and granular DLP security policies.
To identify potential data leaks, Mimecast’s solution scans all inbound and outbound email to evaluate against content policies established by IT administrators. Using pattern matching, keywords, file hashes and dictionaries, Mimecast scans all HTML, subject lines, headers, body text and attachments in search of potential leaks.
Benefits of Mimecast’s data breach prevention solution
Advantages of Mimecast Content Control and Data Leak Prevention include:
- State-of-the-art protection against accidental and malicious leaks via email.
- Tamper-proof audit trails to support legal and regulatory compliance needs.
- A unified solution for policy enforcement across multiple sites.
- A cloud solution that provides immediate effectiveness with zero capital outlay.
- Centralized management of all email communication policies.
With Mimecast, data breach prevention policies can be managed from a single web-based console, with organization-wide changes applied in real time. Mimecast enables consistent policy enforcement, even during outages of email infrastructure, and educates users about data breach prevention best practices with automatic notification of policy transgressions.
