Know What Constitutes a Data Breach (And 5 Steps You Should Take If It Ever Happens to You)

Data breaches have been in the news a lot recently. It appears that nobody is immune, even global giants. In 2013, Yahoo suffered the largest data breach ever recorded. 3 billion accounts were compromised. In 2014, eBay suffered a similar fate, reporting that 145 million users had their accounts compromised.

Everyone from Uber to Home Depot, have fallen victim to data breaches. But what are they? And what should you do if it affects your business?

What constitutes a Data Breach?

The term “data breach” applies to any incident in which an unauthorized user accesses sensitive data. In the modern world, this usually occurs when hackers attack a business’s database. However, the term applies to any form of data breach.

If someone walking past your office spies a laptop left unattended with a client’s credit card information open on the screen, this too can constitute a data breach.

Not all data breaches are costly. In fact, most are very minor incidents. For example, one colleague who is not authorised to view certain information, seeing that information over another colleague’s shoulder. These incidents happen all the time, mostly without any adverse effects. However, when a data breach does bring negative consequences, you need to know how to protect your business.

What to do if your data has been compromised

If you have sensitive information stolen from your business’s databases, there are steps you can take to minimize the damage immediately. Speed is of the essence when containing a data breach. The most important thing is to identify the breach early, ascertain what information is at risk, and follow these steps to limit the exposure.

Step 1

The first thing to do after any data breach is assess the scale. You need to find out exactly what information has been stolen or exposed. Is it clients’ login details? Their personal details? Credit card information? Your employee records? Company finances? Emails? Before you can proceed any further, you need to know what you are dealing with.

Step 2

How can the data be used? Is the data encrypted? Is it in cleartext format. If your data has been hashed (scrambled together so as to be unreadable in a generic document) it may be that the data is unusable.

Step 3

Change passwords. If your data has been hashed and requires a password to unlock it, change it. You don’t know if the data breach included passwords that will allow the data thief to unlock the contents of encrypted files. If the same password has been used anywhere else, change it there too.

If your accounts have been compromised in a data breach of another company, change the password on any accounts you have with that company. If you use the same passwords on any other accounts, change it for those too.

Step 4

To stop any additional data loss, take all affected equipment offline immediately. If a laptop was stolen with access to your business’s databases, take it out of the databases. Be sure not to destroy any evidence. Leave everything as it is on the compromised equipment, just take them offline to stop any further breaches.

Step 5

Finally, consult legal counsel. If you have suffered a large-scale data breach you will need a legal expert with experience in handling data breaches. You may be required under federal and state law to disclose the details of the breach to clients.

Your legal counsel can also advise you on your legal options available for pursuing the culprits responsible.