Almost every other week, there are stories about some high-profile organization experiencing a data leak. In the U.S. alone, about 1,802 publicly reported incidents last year resulted in 4.2 billion private records leaking online. This is only the tip of the iceberg since plenty of organizations that suffer leaks won\u2019t usually report it to authorities or make headlines.<\/p>\n\n\n\n
A data leak occurs when sensitive or confidential data is intentionally or unintentionally disclosed to an unauthorized third party. It usually involves the exposure of sensitive files and data such as customer data, contact information, healthcare data, financial information, social security numbers, credit card information, etc.<\/p>\n\n\n\n
Leaks can be far more than a temporary terror \u2014 they may change the course of your life. Businesses, governments, and individuals alike can experience huge complications from having sensitive information exposed. Whether you are offline or online, hackers can get to you through the internet, Bluetooth, text messages, or the online services that you use.<\/p>\n\n\n\n
A small vulnerability can cause a massive data breach without proper attention to detail. And since many people are unaware of how common modern security threats work, they don\u2019t give it enough attention.<\/p>\n\n\n\n
A data leak is when\u00a0sensitive\u00a0data\u00a0is accidentally exposed physically, on the Internet or in any other form including lost hard drives or laptops. This allows cybercriminals to gain unauthorized access\u00a0to sensitive data without effort. When sensitive data is posted on the dark web following a cyberattack, these events are also classified as data leaks as they help expedite data breaches.<\/p>\n\n\n\n
The terms\u00a0data breach\u00a0and data leak are often used interchangeably, but that’s incorrect as they’re two separate categories of data compromise.<\/p>\n\n\n\n
If a cybercriminal identifies a data leak, the exposed data could be used to strategize a successful cyberattack. So by detecting and remediating data leaks before they are discovered, the risk of data breaches is significantly reduced.<\/p>\n\n\n\n
According to a recent report by the Identity Theft Resource Center (ITRC), in 2021, data compromises went up by almost 70%<\/a>, which is almost 25% more than the previous all-time high record set in 2017. <\/p>\n\n\n\n The average yearly cost of data breaches is\u00a0nearly $4.5 million in 2021, so it is no wonder that more organizations are now implementing data protection measures to prevent data leakage. This includes the consequences associated with it, such as regulatory fines, lawsuits, and loss of customer trust.<\/p>\n\n\n\n Employees contending with heavy workloads and very stringent deadlines may use workarounds and unapproved third-party applications and solutions to get things done. The resulting infrastructure is called \u201cshadow IT.\u201d Some unsanctioned third-party applications and technology employees are likely to use may include:<\/p>\n\n\n\n Although employees using their own systems and devices can help with productivity, the risk is that shadow IT can lead to unauthorized access to data in the cloud, which can result in information leakage, changes to the data by unapproved users, and data corruption. <\/p>\n\n\n\n Additionally, shadow IT creates blind spots for IT teams who may not become aware of the data leak until it is too late.\u00a0<\/p>\n\n\n\n Phishing continues to be a popular way to attack businesses\u2014because it works. Its tactics can expose and allow exploitation of sensitive company data if an employee:<\/p>\n\n\n\n The consequences can range from unauthorized data access to the installation of malware and other malicious files. <\/p>\n\n\n\n Despite technological advances, numerous organizations and their employees are still using certain legacy tools, such as external USB drives, desktop email applications, and public printers. While there is nothing inherently wrong with these tools, they can cause a leak. <\/p>\n\n\n\n Imagine\u00a0an employee losing a USB drive containing sensitive data in a public place. Or imagine private company documents being printed at home or a public printing center.\u00a0<\/p>\n\n\n\n In 2018, Twitter urged its\u00a0330 million users\u00a0to change and update their passwords after a bug exposed them. This was the result of a problem with the hashing process, which Twitter uses to encrypt its users\u2019 passwords. The social networking site claimed it found and fixed the bug, but this is a good example of potential vulnerability exploits.<\/p>\n\n\n\n Twitter also suffered a potential breach in\u00a0May 2020, which could have affected businesses using its advertising and analytics platforms. An issue with its\u00a0cache\u00a0saw Twitter admit it was \u201cpossible\u201d that some users\u2019 email addresses, phone numbers, and the final four digits of their credit card numbers could have been accessed.\u00a0<\/p>\n\n\n\n The main thing that cyber criminals look for is\u00a0personally identifiable information (PII). Personal information includes social security numbers, credit card numbers and any other personal details that could result in\u00a0identity theft. Note that not all personally identifiable information (PII) is what you would traditionally think of as confidential information. Simple data like a name or the mother’s maiden name are targets too.<\/p>\n\n\n\n Another common target is medical or\u00a0protected health information (PHI)\u00a0as defined in the\u00a0US HIPAA standard, “information that is created by a health care provider [and] relates to the past, present, or future physical or mental health or condition of any individual.”<\/p>\n\n\n\n This data differs from company to company, but there are usually some common factors involved:<\/p>\n\n\n\n Information that is specific to the company can also be exposed. This can be financials for banks and investment groups, medical records for hospitals and insurers or sensitive documents and forms for government entities.<\/p>\n\n\n\n Customer information isn’t the only thing. Corporate information can be leaked including:<\/p>\n\n\n\n The exposure of this type of information can hamstring company projects, give competitors insight into business operations, and reveal internal culture and personalities. The bigger the company, the more interest there is in this type of data.<\/p>\n\n\n\n Analytics rely on large data sets containing multiple information sources that reveal big-picture trends, patterns and trajectories. As important as analytics are for many businesses, the data needed to perform the analytics can be a\u00a0vector of attack\u00a0if not properly secured. Analytics data includes:<\/p>\n\n\n\n Analytics gives you a way to understand individuals as a set of data points and predict their next actions with a high degree of accuracy. This may sound abstract but this type of data can be used to sway voters and change the tide of elections by persuading at scale. on can cause reputational damage.<\/p>\n\n\n\n This is the most dangerous thing to be exposed in a data leak. Information that is critical to your business and its ability to compete. Trade secrets include: <\/p>\n\n\n\n Exposure of this type of data can devalue the products and services your business provides and undo years of research.<\/p>\n\n\n\n Mitigation strategies are abundant, but processes can grow in complexity, so it\u2019s wise to partner with cybersecurity services. Cited below is a partial list of some best practices to follow to reduce the risk of data leaks.<\/p>\n\n\n\n Most breaches are a result of\u00a0human-caused errors. Organizations must educate employees on the perils of data leaks and best practices when it comes to storing, protecting, transmitting or sharing sensitive data. Regular security awareness training helps employees be more alert, responsible and accountable for data security.<\/p>\n\n\n\n It also helps develop security behaviors such as higher sensitivity to phishing attempts, safe browsing and better social media etiquette. All of these help to lower the risk of accidental data leaks.<\/p>\n\n\n\n Avoid giving employees blanket access to all data. Limit use of administrator privileges and enable access to only those employees who require it. Restrict data downloads. Create a zero-trust environment so that only authenticated and authorized users have access to critical systems. <\/p>\n\n\n\n Also mandate the use of multifactor authentication to reduce the risk of identity theft.<\/p>\n\n\n\n Review and classify your data regularly. Focus on sensitive data and use data leakage prevention tools to monitor and control the movement of data. Deploy encryption so that sensitive data can be encrypted and secured while at rest, in transit or in motion. Use data discovery tools to carry out content analysis, tracking the movement of sensitive content across the network. <\/p>\n\n\n\n Use mobile device management tools with the ability to remotely wipe devices that have been lost or stolen.<\/p>\n\n\n\n Uber,\u00a0Samsung,\u00a0Toyota\u00a0and others have suffered breaches due to vulnerabilities in third-party suppliers. Be sure to conduct thorough due diligence on critical suppliers and ensure that they deploy best-in-class security standards and processes. Third-party risks also originate from APIs, applications and software. <\/p>\n\n\n\n Remember to maintain a software bill of materials (SBOM) so that businesses can track and monitor the security risks of various components.<\/p>\n\n\n\n Scan your IT environment regularly for bugs and vulnerabilities. Patch systems regularly to plug loopholes and vulnerabilities. Configure firewalls, clouds and other security systems so that attackers cannot take advantage of misconfigurations and open ports.<\/p>\n\n\n\n If needed, leverage a third-party provider to test your security defenses by carrying out quarterly penetration tests.<\/p>\n\n\n\nTypes of data leaks<\/strong><\/span><\/h2>\n\n\n\n
Shadow IT<\/strong><\/h3>\n\n\n\n
\n
Phishing<\/strong><\/h3>\n\n\n\n
\n
Legacy tools<\/strong><\/h3>\n\n\n\n
Privileged or business users<\/strong><\/h3>\n\n\n\n
What do cybercriminals look for in data leaks?\u00a0<\/strong><\/h2>\n\n\n\n
Customer Information<\/strong><\/h3>\n\n\n\n
\n
Company Information<\/strong><\/h3>\n\n\n\n
\n
Analytics<\/strong><\/h3>\n\n\n\n
\n
Trade Secrets<\/strong><\/h3>\n\n\n\n
\n
How to prevent data leaks<\/strong><\/h2>\n\n\n\n
Train employees well<\/strong><\/h3>\n\n\n\n
Tighten employee access and privileges<\/strong><\/h3>\n\n\n\n
Monitor data closely<\/strong><\/h3>\n\n\n\n
Clamp down on third-party risks<\/strong><\/h3>\n\n\n\n
Plug loopholes proactively<\/strong><\/h3>\n\n\n\n
Recommended Articles <\/strong><\/span><\/h2>\n\n\n\n
\n
References<\/strong><\/span><\/h2>\n\n\n\n
\n