# data[].attributes.body
Data Breach - Why is it Harmful and How Can it be Avoided (enterprisesecuritymag.com)

Main idea:

Arguments/facts:
-
-
-
-

Dialogue:

Summary:

APA

# data[].attributes.attachment_link.readable_text
Enterprise Security Magazine | Friday, November 30, 2018

The cybersecurity breach survey has reported that in 2017, 46 percent of all UK businesses had at least reported one cybersecurity breach or attack. The figure has increased exponentially from 2016 when only 24 percent of the businesses reported one or more such cybersecurity breaches. Enterprises and companies are generally under a huge rush and they often forget about data security. In case of new businesses, a can result from a varied set of reasons. Although, lots of organizations are a victim of a complex data hack, often is not the case.

Phishing emails are one of the most common causes of data breaches as 72 percent of businesses report that they have become the victim of cyber attacks through fraudulent emails. These breaches generally happen because an employee accidentally passing t he data to someone else, or sometimes the data m ight also be taken by a former employee. A simple way to avoid this type of breach is to limit the access of sensitive data to the relevant team members and also to limit the access of the employees who are on leave.

Updating each and every system of an organization with necessary anti-virus and anti-malware software is one of the ways to prevent an organization from falling as a victim of data breach. Firewalls should also be put in place to prevent unauthorized access to the company's network. Taking these precautionary measures can limit the hacker's access, thus avoiding multiple security breaches.

Another method to avoid data breach is to identify if an organization is particularly vulnerable to any security attack. By conducting regular data tests and audits, the comp any can get proof that their data is secure. If not, they can take the necessary steps to minimize the breach. This can be achieved with the help of an information security management (ISM) system. An ISM manages all the security processes in one place. It also comes with a framework that helps organizations protect their data and sensitive information through effective technology, auditing, and testing practices.
Check out: Top Fraud And Breach Protection Companies

# data[].attributes.attachment_link.title
Data Breach - Why is it Harmful and How Can it be Avoided

# data[].attributes.attachment_link.description
The cybersecurity breach survey has reported that in 2017, 46 percent of all UK businesses had at least reported one cybersecurity breach or attack. The figure has increased exponentially from 2016 when only 24 percent of the businesses reported one or more such cybersecurity breaches.

# data[].attributes.body
Main idea: 8 Reasons Why Social Media is Bad for Your Data Security.

Arguments/facts:
-Steals your data to show successful ads.
-Closed groups don't assure anonymity, and might backfire you in real life.
-Your personal information can be used to blackmail you.
-Social media is easier to spread scams.
-Cybercriminals can steal enough personal information, and can open a credit car in your name.
-Cybercriminals also create fake businesses.
-We can get our data stolen through our friends.
-Automatically track and collect your location data.
-Even if you eliminate your account, the platform stills owns your content.

Dialogue:
It's scary that even after deleting your account they still have your content.

Summary:
There's a ton of people using social media nowadays. Social media takes your data to target particular people with effective ads. Closed groups don't guarantee complete anonymity and may expose personal information, which can affect you in real life. By threatening to impersonate you, someone could exploit your personal information and demand money from you. Scams that steal your account and password circulate more easily  on social media. Cybercriminals are capable of stealing enough personal data to enable them to start a credit account in your name. Cybercriminals also may set up fictitious firms to trick individuals into disclosing their credit card information. Although we don't always directly expose our data, if one of our friends accidentally does, we run the risk of having it stolen. The majority of smartphones track and store your location data automatically. Digital networks are interested in this kind of information. The social media platforms still own your contents, even if you decide to deactivate or delete your account.

APA
Wilson, Michelle. (2019). 8 Reasons Why Social Media is Bad for Your Data Security. Retrieved from
https://www.hp.com/us-en/shop/tech-takes/8-reasons-why-social-media-is-bad

# data[].attributes.attachment_link.readable_text
Social media is everywhere. In some ways, it's made the world feel smaller by bringing distant people together, reuniting long lost relatives, and otherwise giving people a space to connect. However, as social media has grown over the years, so has the risk of data breaches.

As more and more information gets placed online, there is an increased danger of hackers, companies, and malicious interlopers mining your data in ways that undermine personal privacy. And in some cases, your data is outright stolen.

In our modern world, do we trade our use of social media for data by giving up our right to privacy and the preservation of sensitive, personal information?

Below, we will examine why social media is bad for your security and what makes it rife for harvesting data in the first place. In addition, we'll show why social media is good so internet-users can be more aware of the steps they can take to shore up their accounts from unwanted tampering and data-gathering.

Social media by the numbers

The global use of social media has risen dramatically thanks to the spread of the internet and the advent of cheaper technology. As it stands today, the number of social media users is estimated at 3.196 billion, up 13 percent year-on-year [1].

The heavy hitter in the social media world, of course, is Facebook with 1.86 billion active monthly users [2]. Facebook is also the social media channel arguably under the most scrutiny for its various data breaches and security concerns, especially over the Cambridge Analytica scandal.

With those kinds of numbers and widespread usage, it's easy to understand why that data is valuable. The point of social media is to strategically target ads to users who are likely to click on them. By converting those users to consumers, companies make money. In fact, online social media ads brought in $40 million in revenue last year [3].

Bottom line: the better advertisers can target ads and the more relevant the ads are to your interests, demographics, location, and political leanings, the more likely you'll convert. So, big data means big money.

You may not put much thought into what you "like" on Facebook and what company pages you follow, but each click gives advertisers more access to your personal data than you might think.

Why is social media bad for your data security?

With any service that puts a premium on personal information, there will be risks that your data will be exposed whether by accident or through security loopholes. Below, we've laid out some examples of major flaws within different social media platforms and what kind of data is at stake. Here are 8 reasons why social media is bad for your data.

1. Closed groups and discrimination

There are specific social groups on Facebook, some of them are based on medical issues and addiction. Users share their experiences and issues freely in these groups, believing that a "closed group" affords them some anonymity. Unfortunately, a Sky News investigation found these groups can easily be found alongside membership lists [4].

So, what's the big deal?

Although insurance companies aren't supposed to discriminate against pre-existing conditions, not all of them are scrupulous when it comes to following this law [5]. Insurance companies and employers who find personal information can use it against you to either drop you from your coverage or fire you from your current position [6].

In one case, one woman's home insurance company canceled her coverage because they claimed she had a dog that was a dangerous breed not allowed under the terms of her policy [7]. How did they find this information out? Through a social media post on Facebook. The woman was eventually able to reinstate coverage after proving her dog's breed. However, these kinds of instances of social media screening are becoming more and more frequent.

If you're applying for a job, it's likely that the company will do a cursory screen of your social media to filter out candidates who have any glaring red flags like negative posts about past employers, hate speech1. , or other questionable behavior.

For employers, this social media searching is a gray area, especially if it results in discriminating against someone in a protected class. With that said, it's important to be savvy and cautious about what you post on social media, you never know who might be looking. This is especially true if your account is public with relaxed security settings.

The information you post can also be used for a whole host of nefarious purposes like building up a fake profile, for example. This leads to the next major issue as to why social media is bad for data security.

2. Fake profiles and impersonation

Online criminals target social platforms because your account is rife with personal information they can use for a variety of purposes [8]. The information gathered can be used against you via blackmail or to impersonate you.

3. Spam, viruses, and malware

Social media is a better, faster way to spread malicious content like scams and malware - more so than the run-of-the-mill spam emails you see asking to help out a Nigerian prince in your inbox.

Why is this the case? When someone gets a link from their friend or a social media contact, they're much more likely to click the link as they have no reason not to trust it.

Take this famous virus: the fake "Facebook Videos" phishing scheme. You get a link from a friend, the title suggests it's a video with you in it. Then, a popup appears for a "Facebook Videos" login screen. If you type your login credentials into this popup, you're handing over your password and username information to the scammer. Then, the scammer uses that information to send the same video to all of your friends [9].

4. Opening credit cards and bank accounts

If a cybercriminal gets enough of your information, he or she can also open a credit card or bank account in your name.

All they need is your Social Security number, your name, your birthdate, and address in order to take out loans or credit cards in your name.

Hackers may also be able to intercept your tax refund by turning in a fake tax return with just a birthday, name, and Social Security number. You might only find out when your own, real tax return gets rejected by the IRS [10].

Again, hackers often use phishing scams to get these sorts of credentials where you unknowingly hand over sensitive information.

5. Business fraud

If cybercriminals get ahold of an account, they can believably trick people into thinking they are legitimate businesses. Then they can funnel money straight into their pockets by persuading unsuspecting parties to provide credit card information for products they'll never receive [11].

6. Access tokens and third-party apps

British Consulting firm Cambridge Analytica took the data of at least 87 million users without their knowledge after harvesting that data from people who partook in a third-party quiz app. Cambridge Analytica then sold this information to the Donald Trump campaign.

The catch? 87 million people didn't take the quiz. The app took advantage of a Facebook loophole that allowed it to get the information from the quiz but also all of their friends' data and information as well [12].

In addition, Facebook had another huge breach in 2018 that may have exposed as many as 50 million accounts. A new video uploader introduced bugs that potentially allowed hackers to obtain a user's access tokens which are linked to any other service or page a user is logged into with his or her Facebook credentials [13].

7. Location-based apps

Most people's smartphones already automatically track and collect location data [14]. Social media apps are especially interested in their data because it gives insight into your habits and whereabouts which advertisers can use to target ads to you at certain times of the day.

Without any true guidance or legislation guiding these services in the US, there's a ton of leeway with how this data is used. In addition, there are major security concerns with these apps. Location data can be targeted by burglars or stalkers because of geo-location information that's shared by them.

8. Invasive privacy agreements

Privacy agreements on many social media apps state that the content users upload including pictures, videos, and messages are owned by the platform, even if you decide to delete your account [14].

Why is social media good for your data security?

Although social media is full of examples of how it can be misused and manipulated, there is also a silver lining: it forces users to more closely examine their own expectations, privacy settings, and security concerns.

Here's a list of what to look for in a privacy policy before signing up to join any social network [15]:

1. Who has ownership over the data a user posts or uploads?

2. Where does the data go when a user's account is closed or deleted?

3. How do users stay informed about privacy policy changes?

4. Where and how can a user complain about a privacy breach?

5. How long is personal data stored for?

In addition, you'll want to follow the tips below to make sure that all of your social media platforms are at the most secure level. At the very least, you should know what privacy settings you currently have and how they can be changed.

1. Read the fine print

Social media platforms often persuade users to accepts terms of use that benefit the platform itself rather than the users. Make sure you know what you're signing up for by reading their data policy terms.

You don't want to forget about those third-party apps, either. They're often mining data you have openly available, so make sure that you know exactly what information an app is using.

2. Use strong passwords and anti-virus protection

Users should focus on passwords that aren't easy to guess. If possible, you should change your passwords from time to time. And above all, don't use the same password across all social media sites.

While not foolproof, anti-virus software still acts as a barrier that can offer you and your devices a measure of security.

3. Be careful who you befriend

Don't accept a new friend request from someone you don't know. Facebook reported that 8.7 percent of its total profiles are fake [16].

Does deleting your social media account help prevent your data from getting compromised?

If you've read this article and you're ready to go nuclear to scrub your social media presence from the internet, we don't blame you. While deleting your account can help limit the scope of what information is available on the internet about you, it's not an ironclad way to ensure your data won't be compromised.

Takeaways

While there are plenty of reasons why social media is bad for your security and privacy, it does provide a learning opportunity for casual to professional users to learn how to better protect your information online. By paying attention to privacy settings and third-party app permissions, you'll be on the path to browsing and enjoying the internet more safely.

# data[].attributes.attachment_link.title
8 Reasons Why Social Media is Bad for Your Data Security

# data[].attributes.attachment_link.description
Social media is everywhere. In some ways, it's made the world feel smaller by bringing distant people together, reuniting long lost relatives, and otherwise giving people a space to connect. However, as social media has grown over the years, so has the risk of data breaches.

# data[].attributes.body
Main idea:
Smartphones are the objects that know the most about us.
Arguments/facts:
-Modern smartphones are vastly more powerful than the world’s most capable computers from a few decades ago.

-Your smartphone’s memory holds pretty much everything about our lives.
-If our phone has all this data about us, who gets to see it?
-While this data is anonymized, it turns out to be pretty easy for companies to figure out who you are if they want to.

Dialogue:
Is there any way for us to avoid that our smartphones know this much about us?
Summary:
It is basically impossible to own a phone without its apps and programs knowing pretty much everything about you. From enabling certain apps to access your camera and pictures to the cookies you accept in basically any website, all these functions are just subtle ways of programs accessing your data with your permission.

APA
Are Smartphone Apps Stealing Your Personal Data? (2020, September 14). DataStealth. Retrieved January 25, 2023, from https://datexdatastealth.com/blog/are-smartphone-apps-stealing-your-personal-data

# data[].attributes.attachment_link.readable_text
The short answer is yes, they are. Apps always ask for permission to look at this or that on your phone. But what happens to the data they acquire? And who, exactly, gets to see that data? The story is far more complicated than people commonly realize. So keep reading to find out what's really going on.
What does Data Mining Mean, Anyways?
It is easy to get confused when talking about this stuff, so let's start at the beginning. What is data mining? According to Investopedia:
"Data mining is a process used by companies to turn raw data into useful information."
Digging in a bit further, data mining is the process of discovering new information by analyzing massive amounts of data. When you analyze enough data, patterns and statistics can emerge that wouldn't otherwise be visible. Businesses will mine data gathered from customers to help them market their products better.

Here is a simple example. Upon analyzing sales data, a company might discover that most of their customers live in big, East Coast cities. Using that information, they might shift their marketing to cater to people who live in those cities.

Data Mining can be very powerful. In general, the more data used in the analysis, the better. So companies have large incentives to gather as much data as they ca n. This is where smartphones and smartphone apps come into the story.
Why Would You Want to Mine Smartphone Data?
If you want to learn about people, ask their smartphone. Our phones know so much about us that it is scary. These little devices are extremely powerful computers equipped with huge amounts of memory, an incredible set of sensors, and fast connections to the Internet.

It is sometimes hard to grasp the power of these little beauties.

According toProcessing Power Compared, the computers that guidedApollo 11to the moon in 1969 had a2 MHz processor with 4 KB of memory.

In 1985, the newCray-2 supercomputerwas one of the most powerful computers in existence. It was capable of1.9 GFLOPS(billion floating-point operations per second).

How do these numbers compare with our smartphones? I use a Samsung Galaxy S9+. According to AnandTech, the graphics processor alone on my phone has a theoretical maximum speed of247 to 370 GFLOPS. That makes just the graphics processor in my phone close to200 times faster than the Cray-2!

Then there is the memory. According to the original brochure, the Cray-2 featured256 million, 64-bit words of memory (about 1 billion bytes of memory). My phone has6 GB (6 billion bytes of memory) for apps and its operating system along with 256 GB of additional storage.

Modern smartphones are vastlymore powerful than the world's most capable computers from a few decades ago.

But what makes smartphones even more interesting for data mining is the rest of the package.

Your smartphone's memory holds pretty much everything about our lives. We store our personal information in them:bank information, photos, private messages, everything.

Now throw in incredible sensors that didn't even exist a few years ago, like multiple HD-quality cameras, GPS, biometrics, and so on. With these, our phones canaccumulate all sorts of additional information about u s. In particular, our phones know where we are and where we have been. As someone once said, "We may not know where we were or what we did last night, but our phones do."

Since our phones know virtually everything about us, the big question becomes, " Who gets to see my personal data?" Of course, the apps that we enter data into get to see it, but who else does it go to. In many cases, the people who write the code libraries that app developers use to run ads on your phone (we'll call them "third-party developers" for simplicity) also get to see your data.
Third-Party Developers Get My Personal Data?
Yup. Code libraries are pre-built chunks of computer code that developers can use to do standard functions (run ads in this case) without having to write the code themselves. This is a great way tobuild apps sinceit allows you toget them written faster. But some of these libraries are problematic.

In a 2018 interview by the Chicago Tribune, Jason Hong of the Human Computer Interaction Institute at Carnegie Mellon University explained thatmany apps access sensitive personal data because the third-party developers won't let app developers use their code unless the app gathers that data and passes it along to the ad companies. As a result,your personal data gets shipped off to who knows wherefor use by the third-party developers and whoever they share it with.

Just last month, Burton Kelso, Technology Expert at Integral Computer Consultants, told MSN.com that:

"Your data can be sold to advertisers, people who are looking to get information and background checks on individuals. The worst-case scenario is if this information winds up in the hands of a criminal via a data breach." Burton Kelso, Technology Expert at Integral Computer Consultants

And speaking of your phone knowing where you were last night...

According to the New York Times:

"At least 75 companies receive anonymous, precise location data from apps whose users enable location services to get local news and weather or other information, The Times found." New York Times

While this data is anonymized, it turns out to be prettyeasy for companies to figure out who you are if they want to.

Imagine that the anonymized data shows something like this: A phone leavesyour house, goes towhere you work, then goes to arestaurant you frequent, then goes back to your house. It is a pretty safe bet whose data they're looking at.

While it is easy to disable the location tracking features in our phones, doing so will cripple apps like Waze or Foursquare that need to know where you are to do their jobs.
They Send My Personal Data to Facebook Too?
Earlier this year, from this article in the Wall Street Journal, we learned that many apps take the personal data you enter into them and immediately send it to Facebook. This could happen even if you didn't have a Facebook account.

Two of the apps tested by the Journal were Instant Heart Rate: HR Monitor, and Flo Health Inc.'s Flo Period & Ovulation Tracker. These apps used an analytics tool from Facebook, which, among other things, passed data back to Facebook for analysis and ad targeting. The following screen capture shows the Journal's diagram of how even a non-Facebook user's ovulation status could be entered into Flo Period & Ovulation Tracker, but wind up in a Facebook ad targeting database.

We're not trying to accuse any of these companies of doing anything dishonest. Facebook says the companies were mistaken in sending such personal data to them and that everyone involved is taking steps to prevent such problems in the future.
What we are trying to do is show you how your personal data can find its way to places you would never expect it to go.

Apps Can Ignore Permissions and Still Grab Your Dat
Okay. We're still not accusing anyone of anything. But according to the nonprofit research center International Computer Science Institute, thousands of Android appshave the ability to take data from your phone even when you don't give them permissionto do so. So says this July 2019 report from Fox 2 News in Saint Louis.

Researchers at the Institute discovered 60 apps that were activelycircumventing the permissionsand a large number of apps that contain code that would allow them to do so.

One example dealt with permission to see the location of the phone. A user can turn off the Location permission, blocking that app from accessing that information directly.

However, photos taken on a phonecontain metadata which includes thelocationwhere the photo was taken. Apparently, some photo apps relied on the metadata to find the location of the photo. In effect,the app ignored the intent of the user, which was not to share the location of the photo with the app.

The researchers who found the problem say that the activities might not bemalicious or intentionally circumventing permissions. Indeed Google classified this problem as a bug and paid the researchers a bounty for finding the problem. A fix is supposed to be included in the upcoming Android Q update.
Things to Do to Minimize the Risk to Your Personal Data
Now that you've seen what can happen to your personal data when apps have access to it, here are some things you can do to protect yourself.

While it isexcitingto be the first one in your group to use a new app, it is alsorisky. If you are a computer industry old-timer like this author, you may remember a rule of thumb that went something like this, "Never install a new program from XXXXXXXX(name hidden to protect the guilty)until they have released their third update." That was way back in the early days of the personal computer, but it is still a good philosophy. Things just move a lot faster now.

If you wait 3 or 4 weeks to download a new app, you give other people the time to find any problems with the app. Not just any privacy violations, but bugs and other issues as well. There may even be an update or two (or more) that fixes any problems by the time you download the app.

If you wait a few weeks before installing a popular new app, you should be able tofind some decent reviews. Sometimes there will be lots of word of mouth warnings about an app (seeour story on FaceAppfor a recent example), but that is the exception.

Most of the time, you will need tolook for reviewsto see if there are any issueswith a particular app. You can get a sense of the situation by checking the reviews in the app store. But for the most insight into an app, you'll want towait a couple of weeks after launc h and look for actual reviews using your favorite search engine.

Even if you can't find reviews of a particular app, you may be able tofind information about the company that publishes it. Check out their website. See if their name comes up associated with terms like "scandal," "hack," or "scam." If you don't find any problems, itdoesn't guarantee that your data is not at risk, but finding lots of problems with a publisher is agood signyou should look for an app from someone else.

This is more of a philosophical approach than a universal solution. If an app is free, it is likely that the developers aremaking money bysellingwhateverpersonal data the app has access to.

If you pay for an app, the developers have a way to make money thatdoesn't involve stealing your personal data. This doesn't guarantee an app won't mine your data, and it doesn't prevent third-party library developers from doing so. But in theory, they won't have to.

Unless the app you are interested in does something totally unique, there are probablypaid competitors available. If there are paid competitors, they are easy to find.

To find a competing paid app, simply:

Think of a word or short phrase that describes what the app does. For this example, I am interested in a VPN app for my Android phone.

Go to the app store or read ourbest vpnpost

Enter the word or phrase into the search box.

The app store will return matching apps in a list.

Take a look at any paid competitors, and compare the personal data they request to that requested by the free app. If the free app requests additional data, the paid app may be the better option.

Finally, before installing an app, read the fine print. See what permissions the app wants you to give it.Do they make sense for this particular app? If not, they are probably mining and selling your data.

For an extreme example, I once was looking forflashlight apps. You know, the kind of app that turns on the phone's camera flash and keeps it on so you can use the phone as a flashlight. One app looked promising until I looked at thePermissions it requested. It wanted crazy stuff likelocation data and full network access.

Since the app only turned the light on and off, I couldn't see a legitimate reason for it to have these additional permissions. I chose to i nstall a different appthat didn't ask for personal data unrelated to the problem at hand.

Also avoid apps in areas like casino, free vpns, torrenting etc as they are always full of weird stuff.
Conclusion: Many Smartphone Apps ARE Mining Your Personal Data
Let's wrap this up. Many smartphone apps are stealing your personal data and doing all sorts of stuff with it. There are steps you can take to reduce the risk of an app using your data in ways you don't like. But with the constant change in the smartphone world, and unscrupulous advertisers, programmers, and hackers eyeing all that delicious data on your phone, you can never be 100% sure your data is safe.

Besides taking the protective steps we've listed here, it may be time to think about exactlywhat data you store on your phone. Having everything at your fingertips (or in your pocket) is a great convenience, but the more apps you run, the bigger the target you are.

Do you really needaccess to your bank account from your phone? Torecord your ovulation status there? To carry thosepictures of your significant other wherever you go? Do you really need totake your phone with youif you are going to a political rally or a medical clinic or some other sensitive location?

Like you, we love our smartphones. But we all need a little time away from those we love. Maybe it is time to apply that philosophy to our phones too.

The post " Are Smartphone Apps Stealing Your Personal Data " was first posted on Blockt written by Bill Mann

# data[].attributes.attachment_link.title
Are Smartphone Apps Stealing Your Personal Data?

# data[].attributes.attachment_link.description
The short answer is yes, they are. Apps always ask for permission to look at this or that on your phone. But what happens to the data they acquire? And who, exactly, gets to see that data? The story is far more complicated than people commonly realize.

# data[].attributes.body
Main idea:
There are many reasons to why a hacker would try to steal your data, but it's mainly because it is a very profitable business.
Arguments/facts:
- Hackers can sell your data to other criminals
-Stolen personal information is fuel for identity theft
-Stolen data is used to target phishing attacks and extortion
-Login details are needed for account takeover
-Stolen personal information can be used to harm companies

Dialogue:
It is very important to protect ourselves from hackers and pay a lot of attention to them because very often we don't even realize we're being hacked.

Summary:
Hackers are not always obvious or extremely complex informatics, sometimes even by accepting something on a random website or clicking certain links, you can enable access to your personal data without even realizing. The reasons a hacker would want your data are infinite, but the ones listed in the arguments are the main ones.

APA
Why do hackers want your personal information? (n.d.). F-Secure. Retrieved January 31, 2023, from https://www.f-secure.com/en/home/articles/why-do-hackers-want-your-personal-information

# data[].attributes.attachment_link.title
Why do hackers want your personal information? | F-Secure

# data[].attributes.attachment_link.description
Billions of records of personal information are stolen every year in data breaches. But why do hackers want the data? Why is it a threat to you? Find out here.

# data[].attributes.headline
Council Post: When A Data Breach Can Be A Benefit To Your Brand

# data[].attributes.subject
Council Post: When A Data Breach Can Be A Benefit To Your Brand

# data[].attributes.body
Main idea:
Data theft is not entirely a bad thing (for brands)

Arguments/facts:
- Communication opportunity with customers
- Keeping that transparency
- Having a plan is helpful

Dialogue:
I have never though that this dangerous thing could be viewed as positive.

Summary:
Many people believe that this is a dangerous and negative thing, but, even though it still is dangerous, it can be used to your advantage if taken care of properly.
The most important thing during a data breach is to mantain conversation and contact with your customers. Making yourself appear as a trusted person and using negative situations in a positive way can be very advatageous for your brand. In addition, not only mantaining conversation and using this to your advantage will solve the problem. To solve this you must always have a plan prepared in case something like this happens, because, as I mentioned before, this is still dangerous, and you must try and fight back to solve this, and to get rid of the malware.

APA
Rizkallah, J. (2017, July 11). When A Data Breach Can Be A Benefit To Your Brand. Forbes. Retrieved from: https://www.forbes.com/sites/forbestechcouncil/2017/07/11/when-a-data-breach-can-be-a-benefit-to-your-brand/?sh=67546f6f4e6e

# data[].attributes.attachment_link.readable_text
Can a data breach help your brand? It seems like a provocative thought as we have seen too many companies' reputations tarnished by a breach. In reality, no two breaches tell the same story, and how a company reacts and responds to a breach is what will be remembered.

By now, we have all grown used to hearing that it is not if, but when an organization will be breached. As individuals, we have grown accustomed to this sort of breaking news, and we probably have all been personally impacted by one. For an enterprise, however, one of the critical things after a breach is not only how quickly it can mitigate it, but how well it communicates the damaging news to customers and the public. A data breach may not sink a brand, but a response to a data breach may well do that.

The stigma associated with a breach is not nearly as strong as it was four or five years ago. Most of the data breaches that make and stay in the headlines are the ones where the company's response was questioned and its communication criticized. Yahoo! took a lot of heat after its series of breaches, mostly in terms of how lax it was in its approach to cybersecurity. A password reset was not made mandatory, and communication was vague and tardy.

It is human nature to not want to spread bad news. In the case of a breach, it is also challenging to communicate what happened simply because the company itself may not yet know what happened. The impacted organization needs to investigate when the breach started, how it happened and, more importantly, what data was stolen or compromised and whether that data is of sensitive nature, such as personal identifiers, credit card information, health records or even tax records. In many cases, companies learn about being breached through a third party alerting them that some of their data is for sale on the Dark Web. Sometimes these third-party investigators publish the news with little notice for the company to react. And in some cases, companies will wait to alert their customers after being notified.

This may not feel like fair game. So how on earth can a data breach help a brand?
The (Positive) Brand Impact Of A Data Breach
With data breaches being so common today, organizations should start looking at them as an opportunity to interact closely with customers. Transparency is critical to turning what can be a very negative impact on the brand into a positive one. Even if the breached organization doesn't have all of the details at its fingertips to answer the who, what, when, where and why of a breach, openly and swiftly acknowledging that a breach has occurred will go a long way in keeping consumer trust intact. It can keep that transparency going by sharing regular updates on the forensics investigation itself and on the steps being taken to ensure a breach will not happen again.

When it comes to a data breach, it is not just about communication; it is about culture and commitment to customers. Companies that clearly put their customers first will always come back with a stronger reputation. Home Depot is a good example of this: It was extremely proactive in its response, alerting customers even before they had a chance to fully confirm the breach.
You've Been Breached - Now What?
There are many steps to take to mitigate and shut down a breach once it's happened, and every organization should have a response plan in place. They should also all have a crisis communication plan, which ensures that while one team works on the forensics and mitigation aspect of the breach, the other team is busy communicating the details of the breach to its core constituencies. Above all, the communication to customers and to the public should come from the executive team as this will signal just how seriously the breach is being considered.
Five Rules To Follow In Data Breach Communications
To get ahead of the next data breach you may face as an enterprise, here are five communications rules to bear in mind:

1. Have a communications plan in place in the event of a data breach. Within that plan, it's important that you include various scenarios based on whether you know the extent of the breach, what information was breached and the timeline for when the breach most likely occurred. A communication timeline should be established based on the findings, with regular updates shared with various stakeholders.

2. Prioritize your customers and communicate with them first. Customers are the ones who will ultimately help you preserve the reputation of your brand. Recognizing a leak early is always better than waiting for your customers to see it first in the news. This is the fastest way to keep and maintain consumer trust.

3. Involve senior leadership in your communications strategy. Having the message come from the top executives is crucial to showing customers how seriously you take the security incident. Having the whole company aligned behind one message will only strengthen the impact your response has on customers.

4. Be transparent. Outline the steps your company is taking to mitigate the breach and keep the lines of communication open, providing regular updates online (in a blog post, for example) where customers can easily find more information about the breach.

5. Communicate, communicate, communicate. The more you openly discuss the topic, the more in control of the situation you will be perceived. Continue communicating well after the news headlines are publicized to show that your commitment to protecting your customers' data is real and constitutes a significant investment.

While no company is safe from attack today, all companies can be proactive in how they plan for the inevitable. In doing so, organizations can actually turn a very damaging event into a brand-reinforcing event, fostering customer loyalty for the long-haul if handled properly. Brand trust must be protected - this is so important because once consumer trust is lost, it's almost impossible to get it back.

# data[].attributes.attachment_link.title
Council Post: When A Data Breach Can Be A Benefit To Your Brand

# data[].attributes.attachment_link.description
Can a data breach help your brand? It seems like a provocative thought as we have seen too many companies' reputations tarnished by a breach. In reality, no two breaches tell the same story, and how a company reacts and responds to a breach is what will be remembered.

# data[].attributes.body
From Paul O'Brien
Main idea:
Companies are not stealing data, they are taking your data with your concern.
Arguments/facts:
-Companies aren't stealing data
-They have your concern
-They say they are stealing data so that politics can control the internet
-You don't even pay for using the internet, they aren't doing anything that should concern us.

Dialogue: It is true that companies are taking data with your concern but we need privacy.

Summary:
Companies aren't stealing data they are just using them with your concern. You aren't obligated to use this sides. You don't pay for almost anything online, they are not doing anything that should concern you.

APA

# data[].attributes.attachment_link.title
Are companies stealing and using our data bad? How?

# data[].attributes.attachment_link.description
Answer (1 of 3): Hi there, Thanks for the A2A. This is an interesting question and I already have answered this with a perspective to show that whatever companies are collecting is mostly based on the AdTech industry norms. This cannot be referred to as stealing the data because as a consumer i...

# data[].attributes.body
Main idea: Why Would Someone Steal My Data?

Arguments/facts:
-Bosses rank data theft as one of the biggest security threats
-16% of large UK companies suffered successful attacks
-Businesses have an obligation to protect any data
-The weakest link in the cyber security chain is people
-Social engineering is becoming an increasing concern
-Even small companies are targets of data theft

Dialogue:
16% is a lot of companies for something as data theft. I think it's something that should be more protected.

Summary:
Companies hold information that can compromise their costumers. They have to take responsibility to protect this data. Data theft is considered one of the biggest security threats, and last year, in the UK 16% of large companies have suffered successful attack. Social engineering is being used to scam people into giving away sensitive information. And, although it may seem an issue only addressed for large companies, small companies are also being targeted for data theft.

APA
Blizzard, S. (2016, November 11). Why would someone steal my data? Beaming. Retrieved January 31, 2023, from https://www.beaming.co.uk/insights/anyone-interested-data/

# data[].attributes.attachment_link.readable_text
Data breaches. The very thought of them strikes fear into the hearts of business leaders and IT professionals alike.

Beaming research shows that bosses rank data theft as one of the biggest security threats their businesses face and that cyber security breaches cost UK organisations £34.1 billion last year.

The list of infamous incidents of this kind grows longer each year. We won't detail them here ( Techworld already has); suffice it to say that malware, hacks and the actions (or inaction) of rogue employees have resulted in huge fines and reputational damage for those affected.

Almost a quarter (22%) of UK businesses table cyber security matters at board level now and it is a subject we discuss regularly with our clients. But while huge quantities of personal and financial information make large consumer facing organisations obvious targets, leaders of small and medium sized businesses frequently ask why anyone would be interested in their data.

Fear of data breaches is greatest amongst large companies and rightly so; our research shows that 16% of large UK companies suffered successful attacks last year. It is far from being an exclusive big business concern though, 12% of medium sized firms and 4% of small businesses were also victims, with the average cost of managing the impact of each attack estimated at £16,264.

Why would someone steal my data? Don't be fooled into thinking that your small business's customer, client or supplier information is "insignificant" or "uninteresting". Any organisation with customers or financial information is a potential target, and smaller businesses, especially those operating in the supply chain of large organisations are particularly vulnerable.

IT responsibility

Even though they may not be required to name an information handler by the Information Commissioner, any organisation with employees will hold payroll data and other sensitive information that is covered by the Data Protection Act. Businesses have an obligation to protect any data they hold that they wouldn't want to publish publicly on their websites.

Protecting your intellectual assets, customer details and financial information is vital for many reasons, not least because identity theft remains a significant threat for individuals and businesses alike, and fraudsters rely on the information they can harvest from unsuspecting organisations to perpetrate these kind of attacks at scale.

Professional services are themselves particularly vulnerable here. Accountants hold huge amounts of financial information and solicitors are privy to sensitive personal or commercial information that could seriously embarrass their customers if it were to be compromised.

These organisations tend to be highly trusted by their business customers and welcomed with open arms into their boardrooms. Data breaches seriously undermine the credibility of such companies.

Again the main risk is the people element. When you have people carrying devices and pieces of paper containing potentially sensitive information around the outside world the risks of disclosure grows exponentially.

Social engineering

Whether through complacency, manipulation or malicious intent, the weakest link in the cyber security chain is people. Employees were believed to be involved in around half of the breaches suffered by businesses last year and warnings suggest social engineering is becoming an increasing concern.

When it comes to information security, social engineering refers to the manipulation of people into divulging information or performing actions that puts company assets and confidential data at greater risk of theft and disclosure.

Professional services firms have found themselves particularly vulnerable to this kind of attack. In September the head of a fraud ring was sentenced to 11 years in prison for a £113m scam targeting law firms and other businesses. Action Fraud, the national fraud and cyber-crime reporting centre,has warned solicitors and estate agents to be wary of fraudsters using social engineering techniques designed to trick victims out of money destined for house purchases.

Criminals now study companies and the networks they interact in to find a weak link in the supply chain. By understanding how an organisation operates and presents itself, it is then relatively easy for criminals to perform personalised attacks on bigger and more valuable targets.

9% of businesses we surveyed said that they had fallen victim to phishing attacks in the last year. They aren't being taken in by classic requests for help transferring millions out of war torn locations, but by personalised requests purporting to come from key business partners and suppliers. Leaders should expand their consideration of risk beyond the boundaries of their own organisations.

Protecting your business and its partners

Even if you run the very smallest of companies, there are many reasons why criminals would be interested in your data. Businesses must do everything they can to ensure their cyber security defences are up to date to reduce the risk of this information falling into the wrong hands and being used to harm your business, employees, customers and suppliers.

All businesses have a responsibility to protect their assets and ensure that their IT systems are not used for criminal activities. Being ignorant to the existence of botnets on your IT systems is no defence if they are used to perpetrate cyber-attacks on other businesses.

Getting the technology piece right is one consideration. Spam filters, anti-virus software and firewalls must be maintained. Business fibre connections tend to have more sophisticated firewalls than older forms of connectivity, making these networks stronger and more secure. Single broadband routers also need to have their firmware regularly updated to prevent breaches.

People remain the weakest link. The best firms reduce the risk of information taken outside of the office being lost or stolen by hosting it securely in a data centre or the cloud and accessing it remotely using an encrypted internet connection while at their customers' premises.

Protecting yourself, your information and your partners requires sound information security policies and procedures, solid training and a commitment to ensuring you constantly live up to standards required to keep an increasingly sophisticated enemy at bay.

# data[].attributes.attachment_link.title
Why would someone steal my data? - Beaming

# data[].attributes.attachment_link.description
Data breaches. The very thought of them strikes fear into the hearts of business leaders and IT professionals alike. Beaming research shows that bosses rank data theft as one of the biggest security threats their businesses face and that cyber security breaches cost UK organisations £34.1 billion last year.

# data[].attributes.body
Main idea:
What is data theft and how to prevent it?

Arguments/facts:
- Data theft is responsible for 86% of breaches
- Email based phishing is an easy way of stealing this data
- Preventing data theft can be simple

Dialogue:
I had no idea there are so many ways of stealing data, I always thought I was safe, but after reading this article, I realised I probably am not. I also didn't know that legal action may be needed sometimes.

Summary:
Data theft is not as complicated as many of us thought. In addition to that, preventing said theft can also be simple.
The reason why we should care so much about this type of theft is because many companies have suffered in various way due to this. All companies have suffered greatly, most of them couldn't recover some data, some had to take legal action, and some were even held ransom.
Even though this may seem scary, there are some easy things to do to prevent this. Some of these things include protecting access points (changing passwords, multi-factor authentification, monitoring USB usage etc.), limiting access to your accounts, devices etc. And using protected servers, VPNs, wifi and other similar things

APA
Sham, S. (2022, March 10). What Is Data Theft? retrieved from: https://www.okta.com/blog/2020/07/data-theft/

# data[].attributes.attachment_link.description
Okta’s complete guide on data theft. Everything you need to know about the impact of corporate and employee data theft, and tips for data theft prevention.

# data[].attributes.body
Personal data breaches | ICO

# data[].attributes.attachment_link.readable_text
At a glance

The UK GDPR introduces a duty on all organisations to report certain personal data breaches to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible.

If the breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms, you must also inform those individuals without undue delay.

You should ensure you have robust breach detection, investigation and internal reporting procedures in place. This will facilitate decision-making about whether or not you need to notify the relevant supervisory authority or the affected individuals, or both.

You must also keep a record of any personal data breaches, regardless of whether you are required to notify.

Checklists

Preparing for a personal data breach

☐ We know how to recognise a personal data breach.

☐ We understand that a personal data breach isn't only about loss or theft of personal data.

☐ We have prepared a response plan for addressing any personal data breaches that occur.

☐ We have allocated responsibility for managing breaches to a dedicated person or team.

☐ Our staff know how to escalate a security incident to the appropriate person or team in our organisation to determine whether a breach has occurred.

Responding to a personal data breach

☐ We have in place a process to assess the likely risk to individuals as a result of a breach.

☐ We have a process to inform affected individuals about a breach when their rights and freedoms are at high risk.

☐ We know we must inform affected individuals without undue delay.

☐ We know who is the relevant supervisory authority for our processing activities.

☐ We have a process to notify the ICO of a breach within 72 hours of becoming aware of it, even if we do not have all the details yet.

☐ We know what information we must give the ICO about a breach.

☐ We know what information about a breach we must provide to individuals, and that we should provide advice to help them protect themselves from its effects.

☐ We document all breaches, even if they don't all need to be reported.

In brief

What is a personal data breach?

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes. It also means that a breach is more than just about losing personal data.
Example
Personal data breaches can include:

access by an unauthorised third party;

deliberate or accidental action (or inaction) by a controller or processor;

sending personal data to an incorrect recipient;

computing devices containing personal data being lost or stolen;

alteration of personal data without permission; and

loss of availability of personal data.

A personal data breach can be broadly defined as a security incident that has affected the confidentiality, integrity or availability of personal data. In short, there will be a personal data breach whenever any personal data is accidentally lost, destroyed, corrupted or disclosed; if someone accesses the data or passes it on without proper authorisation; or if the data is made unavailable and this unavailability has a significant negative effect on individuals.

Risk-assessing data breaches

Recital 87 of the UK GDPR says that when a security incident takes place, you should quickly establish whether a personal data breach has occurred and, if so, promptly take steps to address it, including telling the ICO if required.

Remember, the focus of risk regarding breach reporting is on the potential negative consequences for individuals. Recital 85 of the UK GDPR explains that:

"A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned."

This means that a breach can have a range of adverse effects on individuals, which include emotional distress, and physical and material damage. Some personal data breaches will not lead to risks beyond possible inconvenience to those who need the data to do their job. Other breaches can significantly affect individuals whose personal data has been compromised. You need to assess this case by case, looking at all relevant factors.
Example
The theft of a customer database, whose data may be used to commit identity fraud, would need to be notified, given its likely impact on those individuals who could suffer financial loss or other consequences. But you would not normally need to notify the ICO, for example, about the loss or inappropriate alteration of a staff telephone list.

So, on becoming aware of a breach, you should contain it and assess the potential adverse consequences for individuals, based on how serious or substantial these are, and how likely they are to happen.

For more details about assessing risk, please see section IV of the Article 29 Working Party guidelines on personal data breach notification.

When do we need to tell individuals about a breach?

If a breach is likely to result in a high risk to the rights and freedoms of individuals, the UK GDPR says you must inform those concerned directly and without undue delay. In other words, this should take place as soon as possible.

A 'high risk' means the requirement to inform individuals is higher than for notifying the ICO. Again, you will need to assess both the severity of the potential or actual impact on individuals as a result of a breach and the likelihood of this occurring. If the impact of the breach is more severe, the risk is higher; if the likelihood of the consequences is greater, then again the risk is higher. In such cases, you will need to promptly inform those affected, particularly if there is a need to mitigate an immediate risk of damage to them. One of the main reasons for informing individuals is to help them take steps to protect themselves from the effect of a breach.
Example

A hospital suffers a breach that results in accidental disclosure of patient records. There is likely to be a significant impact on the affected individuals because of the sensitivity of the data and their confidential medical details becoming known to others. This is likely to result in a high risk to their rights and freedoms, so they would need to be informed about the breach.

A university experiences a breach when a member of staff accidentally deletes a record of alumni contact details. The details are later re-created from a backup. This is unlikely to result in a high risk to the rights and freedoms of those individuals. They don't need to be informed about the breach.

A medical professional sends incorrect medical records to another professional. They inform the sender immediately and delete the information securely. This is unlikely to result in a risk to the rights and freedoms of the individual. They don't need to be informed about the breach.

If you decide not to notify individuals, you will still need to notify the ICO unless you can demonstrate that the breach is unlikely to result in a risk to rights and freedoms. You should also remember that the ICO has the power to compel you to inform affected individuals if we consider there is a high risk. In any event, you should document your decision-making process in line with the requirements of the accountability principle.

What information must we provide to individuals when telling them about a breach?

You need to describe, in clear and plain language, the nature of the personal data breach and, at least:

the name and contact details of any data protection officer you have, or other contact point where more information can be obtained;

a description of the likely consequences of the personal data breach; and

a description of the measures taken or proposed to deal with the personal data breach and, where appropriate, a description of the measures taken to mitigate any possible adverse effects.

If possible, you should give specific and clear advice to individuals on the steps they can take to protect themselves, and what you are willing to do to help them. Depending on the circumstances, this may include such things as:

forcing a password reset;

advising individuals to use strong, unique passwords; and

telling them to look out for phishing emails or fraudulent activity on their accounts.

What breaches do we need to notify the ICO about?

When a personal data breach has occurred, you need to establish the likelihood of the risk to people's rights and freedoms. If a risk is likely, you must notify the ICO; if a risk is unlikely, you don't have to report it. However, if you decide you don't need to report the breach, you need to be able to justify this decision, so you should document it.

What role do processors have?

If your organisation uses a data processor, and this processor suffers a breach, then under Article 33(2) it must inform you without undue delay as soon as it becomes aware.
Example
Your organisation (the controller) contracts an IT services firm (the processor) to archive and store customer records. The IT firm detects an attack on its network that results in personal data about its clients being unlawfully accessed. As this is a personal data breach, the IT firm promptly notifies you that the breach has taken place. You in turn notify the ICO, if reportable.

This requirement allows you to take steps to address the breach and meet your breach-reporting obligations under the UK GDPR.

If you use a processor, the requirements on breach reporting should be detailed in the contract between you and your processor, as required under Article 28. For more details about contracts, please see our draft UK GDPR guidance on contracts and liabilities between controllers and processors.

How much time do we have to report a breach?

You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it. If you take longer than this, you must give reasons for the delay.

Section II of the Article 29 Working Party Guidelines on personal data breach notification gives more details of when a controller can be considered to have 'become aware' of a breach.

What information must a breach notification to the ICO contain?

When reporting a breach, the UK GDPR says you must provide:

a description of the nature of the personal data breach including, where possible:

the categories and approximate number of individuals concerned; and

the categories and approximate number of personal data records concerned;

the name and contact details of the data protection officer (if your organisation has one) or other contact point where more information can be obtained;

a description of the likely consequences of the personal data breach; and

a description of the measures taken, or proposed to be taken, to deal with the personal data breach and, where appropriate, of the measures taken to mitigate any possible adverse effects.

What if we don't have all the required information available yet?

The UK GDPR recognises that it will not always be possible to investigate a breach fully within 72 hours to understand exactly what has happened and what needs to be done to mitigate it. So its Article 33(4) allows you to provide the required information in phases, as long as this is done without undue further delay.

However, we expect controllers to prioritise the investigation, give it adequate resources, and expedite it urgently. You must still notify us of the breach when you become aware of it, and submit further information as soon as possible. If you know you won't be able to provide full details within 72 hours, it is a good idea to explain the delay to us and tell us when you expect to submit more information.
Example
You detect an intrusion into your network and become aware that files containing personal data have been accessed, but you don't know how the attacker gained entry, to what extent that data was accessed, or whether the attacker also copied the data from your system.

You notify the ICO within 72 hours of becoming aware of the breach, explaining that you don't yet have all the relevant details, but that you expect to have the results of your investigation within a few days. Once your investigation uncovers details about the incident, you give the ICO more information about the breach without delay.

How do we notify a breach to the ICO?

To notify the ICO of a personal data breach, please see our pages on reporting a breach. These pages include a self-assessment tool and some personal data breach examples.

Remember, a breach affecting individuals in EEA countries will engage the EU GDPR. This means that as part of your breach response plan, you should establish which European data protection agency would be your lead supervisory authority for the processing activities that have been subject to the breach. For more guidance on determining who your lead authority is, please see the Article 29 Working Party guidance on identifying your lead authority.

Does the UK GDPR require us to take any other steps in response to a breach?

You should ensure that you record all breaches, regardless of whether or not they need to be reported to the ICO.

Article 33(5) requires you to document the facts regarding the breach, its effects and the remedial action taken. This is part of your overall obligation to comply with the accountability principle, and allows us to verify your organisation's compliance with its notification duties under the UK GDPR.

As with any security incident, you should investigate whether or not the breach was a result of human error or a systemic issue and see how a recurrence can be prevented. Human error is the leading cause of reported data breaches. To reduce the risk of this, consider:

mandatory data protection induction and refresher training;

support and supervising until employees are proficient in their role.

updating policies and procedures for employees should feel able to report incidents of near misses;

working to a principle of "check twice, send once";

implementing a culture of trust - employees should feel able to report incidents of near misses;

investigating the root causes of breaches and near misses; and

protecting your employees and the personal data you are responsible for. This could include:

Restricting access and auditing systems, or

Implementing technical and organisational measures, eg disabling autofill.

As mentioned previously, as part of your breach management process you should undertake a risk assessment and have an appropriate risk assessment matrix to help you manage breaches on a day-to-day basis. This will help you to assess the impact of breaches and meet your reporting and recording requirements. This will provide a basis for your breach policy and help you demonstrate your accountability as a data controller.

What else should we take into account?

The following aren't specific UK GDPR requirements regarding breaches, but you should take them into account when you've experienced a breach.

As a result of a breach an organisation may experience a higher volume of data protection requests or complaints, particularly in relation to access requests and erasure. You should have a contingency plan in place to deal with the possibility of this. It is important that you continue to deal with those requests and complaints, alongside any other work that has been generated as a result of the breach. You should also consider how you might manage the impact to individuals, including explaining how they may pursue compensation should the situation warrant it.

It is important to be aware that you may have additional notification obligations under other laws if you experience a personal data breach. For example:

If you are a communications service provider, you must notify the ICO of any personal data breach within 24 hours under the Privacy and Electronic Communications Regulations (PECR). You should use our PECR breach notification form, rather than the GDPR process. Please see our pages on PECR for more details.

If you are a UK trust service provider, you must notify the ICO of a security breach that may include a personal data breach within 24 hours under the Electronic Identification and Trust Services (eIDAS) Regulation. You can use our eIDAS breach notification form or the GDPR breach-reporting process. However, if you report it to us under the UK GDPR, this still must be done within 24 hours. Please read our Guide to eIDAS for more information.

If your organisation is an operator of essential services or a digital service provider, you will have incident-reporting obligations under the NIS Directive. These are separate from personal data breach notification under the UK GDPR. If you suffer an incident that's also a personal data breach, you will still need to report it to the ICO separately, and you should use the GDPR process for doing so.

You may also need to consider notifying third parties such as the police, insurers, professional bodies, or bank or credit card companies who can help reduce the risk of financial loss to individuals.

The European Data Protection Board, which has replaced the WP29, has endorsed the WP29 Guidelines on Personal Data Breach Notification. Although the UK has left the EU, these guidelines continue to be relevant. You should also be aware of any recommendations issued under relevant codes of conduct or sector-specific requirements that your organisation may be subject to.

What happens if we fail to notify the ICO of all notifiable breaches?

Failing to notify the ICO of a breach when required to do so can result in a heavy fine of up to £8.7 million or 2 per cent of your global turnover. The fine can be combined with the ICO's other corrective powers under Article 58. It is important to make sure you have a robust breach-reporting process in place to ensure you detect, and notify breaches, on time and to provide the necessary details, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of data subjects. If you decide you don't need to report the breach, you need to be able to justify this decision, so you should document it.

# data[].attributes.attachment_link.description
The UK GDPR introduces a duty on all organisations to report certain personal data breaches to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible. If the breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms, you must also inform those individuals without undue delay.

# data[].attributes.headline
How Your Smartphone Can Be Used to Steal Your Data

# data[].attributes.subject
How Your Smartphone Can Be Used to Steal Your Data

# data[].attributes.body
Main idea:
Ways data can be stolen from you

Arguments/facts:
- steal data
- scams
- sensitive information
- SMSishing
Dialogue:
what is SMSishing? I think this is also a bit terrifying
Summary:
Telephones are a trivial thing in our lives but they can be our weakpoint. This article mentions the ways our personal information and data can be stolen. From scam emails to physical theft, stealing data can be a very simple thing to do, so if our devices are not protected properly, all of your personal data may be stolen and probably used against you.

APA
Sultan, O. (2022, February 8). How Your Smartphone Can Be Used to Steal Your Data. HackRead. Retrieved from https://www.hackread.com/how-smartphone-can-be-used-to-steal-your-data/

# data[].attributes.attachment_link.provider_name
HackRead | Latest Cyber Crime - InfoSec- Tech - Hacking News

# data[].attributes.attachment_link.title
How Your Smartphone Can Be Used to Steal Your Data

# data[].attributes.attachment_link.description
Our smartphones carry the most sensitive data possible such as passwords, or banking info and that is why they are a lucrative target for hackers.

# data[].attributes.body
Main idea: 4 Ways Hacker Are Using  Data Science to Steal Billions.

Arguments/facts:
-Hackers use machine learning to improve efficiency against humans.

-Hackers use machine learning to overcome security systems once inside.

-Hackers build bots that can click that small checkbox.

-Overloading with DoS or DDoS attacks

Dialogue:

Summary:

APA

# data[].attributes.attachment_link.readable_text
Technology photo created by pressfoto - www.freepik.com

Most data scientists you know are on the "good" side of data science. They work at top tech companies. They use their powers for good, building products, spotting trends, and even actively working to stop hackers. For example, a new field of data science called Phishitycs uses machine learning to stop phishing attacks.

Even if data scientists aren't employed directly, many operate as ethical hackers, using their skills to spot and help companies shore up weaknesses to earn bounties.

However, as data science becomes a more common skill, many hackers are using it as a tool to steal corporate data, personal data, privacy invasion, or any other important information that can harm the business.

It shouldn't come as a surprise. The data science field and the hacking field have a lot in common, despite being on opposite sides of legality. Data science requires a lot of thinking outside the box, problem-solving, and analytical thinking. So does hacking.

The best way to stop your enemy is to know your enemy. Here are four ways hackers are using data science - and how they can be stopped.

1. Hackers use machine learning to improve efficiency against humans

One of the most common - and most successful - types of hacking is imitating other humans at the company to gain access to emails, secure servers, and more. This type of hacking includes spoofing, phishing, spear phishing, and impersonation.

Hackers have begun using machine learning to better imitate human speech and text patterns. Just as machine learning can be used to help natural language processing progress as a field, the same skills can be used to make hackers sound more realistic.

A hacker might use machine learning to analyze how your CTO speaks and writes, using social networks. Then she might successfully impersonate your CTO, getting you to click on a malicious link.

2. Hackers use machine learning to overcome security systems once inside

Artificial intelligence and machine learning can use clever ransomware and malware that are increasingly adaptive against threats.

One issue a lot of companies face is that their security systems are passive and reactive, rather than active. As hackers have built malware that is more and more intelligent and has the ability to recognize security software and adapt to it accordingly to remain hidden, companies must develop their own intelligent security systems.

So far, they have not done so well at this. Last year alone, cybercrime cost companies a total of $20 billion, a number that has been steadily increasing over the past few years.

3. Hackers build bots that can click that small checkbox

Everyone is familiar with ticking the box that confirms you're not a bot, called CAPTCHAs. Most of us are familiar with the slightly annoying and weirdly sad collection of pictures that come afterward, asking us to identify the traffic light, boat, train, or other random objects in a grid.

Even more annoying than me, a human, being asked to prove I'm not a bot is the realization that a bot can probably do that, too. Nowadays, anyone who's used Google's search functionality through images should know that machine learning and algorithms can be used to train bots that are capable of overcoming these security measures.

"There are many ways to get past the text CAPTCHAs on their own. Researchers demonstrated how they could write a program that beats image recognition tests. CAPTCHAs can irritate users, who find themselves stuck on a webpage while waiting for the CAPTCHA test. In some cases, this leads them to feel discouraged and give up altogether," writes Ali Qamar in Techgenix.

4. Overloading with DoS or DDoS attacks

DoS (Denial of Service) or DDoS (distributed denial of service) attacks are among the most famous hacker accomplishments in the news lately. Hackers will overwhelm the bandwidth or infrastructure of their target with a flood of simulated web traffic. This makes it hard or impossible for real visitors to use the site, disrupting commerce.

The biggest attack was on Google back in 2017 - though they only disclosed the attack in 2020.

While DoS attacks can use a single device, sturdier DDoS attacks rely on a network of "zombies," which are devices infected with a particular malware that allows a hacker to remotely control their activity. These DDoS attacks rely on algorithms to coordinate these attacks together. As the IoT has become more widespread, hackers have grown more proficient at infecting just about any device, from a company server to the wifi-enabled fridge.

How can companies overcome these issues?

Reading the list above, it's easy to feel overwhelmed. Luckily, for every hacker, there is a data science working diligently to stop them. The same tools can be flipped around and made to protect companies rather than infiltrate them. Not only that but a lot of attacks can be stopped with training and common sense. Here are three ways to rebuff modern hackers.

1. Invest in the right technology

Hackers evolved when companies began moving to the cloud since a lot of security issues arise when a company moves to the cloud, which improves service but causes greater security threats. To address this weakness, many companies are upgrading too, using a secure access service edge, or SASE. Being able to customize security settings and operational needs means companies can flexibly build a security architecture that works for them.

2. Get proactive

Companies should aim to build more proactive and predictive security models rather than the reactive models that are the standard today. Companies can feed machine learning algorithms with historical and current information about cyber intrusions to predict and detect these, working as the human immune system to identify threats even as they shift.

3. Focus on the people, not the machines

One of my favorite folktales about hackers is when a class of future computer scientists was asked to try to hack into their university servers. Most were unable to detect any vulnerabilities or get past the powerful firewalls.

One woman, however, put on a fake lanyard and simply tried to walk into the building where the servers were kept. She pretended her lanyard didn't work and was let through the doors by a helpful employee. Once inside, she pretended she had forgotten the password to log in and asked for it. Again, she was able to get inside the systems.

Her skill wasn't technical, but psychological. Many hackers rely on the same skillset. So many of these hackers can be stopped by reducing human error. Don't click on the link in the email. Don't download the attachment. Don't trust what you read. With that alone, you can eliminate many of the hackers' attempts to get inside.

# data[].attributes.attachment_link.title
4 Ways Hackers Are Using Data Science to Steal Billions - KDnuggets

# data[].attributes.attachment_link.description
Technology photo created by pressfoto - www.freepik.com Most data scientists you know are on the "good" side of data science. They work at top tech companies. They use their powers for good, building products, spotting trends, and even actively working to stop hackers.

# data[].attributes.body
Main idea:
Companies use and profit off our personal data in many ways.
Arguments/facts:
-We accept the sharing of large amounts of personal data with online companies as a part of using the internet without question.
-We are all constantly monitored and analyzed in secret.
- Companies like Facebook and Google know every aspect of their customers and using and selling that personal data to marketers in order to target a specific audience based on a customer’s personal characteristic.
-Customers have simply given over their personal information to these companies without realizing the extent of their actions.
Dialogue:
We underestimate the actions we make and the power and control every website, app or program we use has over us.
Summary:
Especially large companies are constantly using and selling our data for their own profit by providing us with ads we might be interested in which also means that we are constantly observed and tracked down to really achieve this. One of the main problems is that we are simply not realizing this.

APA
How Companies profit and Use Your Personal Data. (n.d.). CBS. Retrieved January 31, 2023, from https://cbscreening.co.uk/news/post/your-personal-data-and-how-companies-use-it/

# data[].attributes.attachment_link.readable_text
In 2017 we live in a digital age where more data is being created and captured in every aspect of our daily lives than any other point in history. CBS, like many businesses receives thousands of pieces of personal information from our customers when they register their details with us. While CBS has strict rules on not using that data or selling it for personal or financial gain, other businesses do not have the same respect for personal information. CBS will look at how people all over the world are willingly or unwillingly creating and sharing more personal data than ever before and what that means for businesses and users. From our morning exercise data that we upload via our Fitbit, what we purchase on eBay during our lunch-break, to ordering dinner online in the afternoon, the ownership and use of the massive amount of personal data that an average person produces is becoming a multi-billion-pound industry. Companies use this data to send targeted marketing, make credit and loan evaluation, medical research, and crime analysis for financial benefit. Consumers are now starting to become more aware of the value of their personal data and how it is being abused for financial gain, often against or without their knowledge and consent.

We have all grown accustomed to hanging up or getting angry at the traditional telemarketers calling our house phone, but paradoxically many people accept the sharing of a much larger and more personal data with online companies as a part of using the internet without question. As the intrusion and use of our personal data grows, consumers are changing their online habits by using data blocking software and becoming more careful with whom they share their personal data online. According to a survey from TRUSTe, a privacy management firm, the percentage of US adults deciding to opt out of online behavioural advertising increased from 27% to 50% in 2016 while IAB UK figures reveal that almost a quarter (22%) of UK internet users use ad blocking software. This trend of consumers taking back control of who accesses and controls their data and what they do with it could change the very structure and process of how we use the internet in the future.

The Bigger Picture

With the recent revelations that governments are spying on people through their TVs, phones and smart watches, whether we choose to give up our personal data could become irrelevant. We are slowly slipping into 1984 style state sponsored surveillance by intelligence agencies, where we are all constantly monitored and analysed in secret, making consumers aversion to adverts for shoes seem naive and superficial in comparison.

A Connected World

The widespread adoption and integration into our lives of the internet over the last 20 years, along with our use of smartphones over the last 10 has led to humans producing more recordable data than ever before. Companies like Facebook and Google have become some of the largest and most powerful conglomerates in the world, making untold billions in the process by knowing every aspect of their customers and using and selling that personal data to marketers in order to target a specific audience based on a customer's personal characteristic. The bulk of spending by brands on digital advertising is largely controlled by the duopoly, with a 75% market share for Facebook and Google in 2015. In 2016, that figure had risen to 85% of every dollar/pound spent on digital being acquired by either Google or Facebook. Customers have simply given over their personal information to these companies without realising the extent of their actions. Think of all the identifiable content you have stored in Facebook that can be used to sell you targeted ads; be it walking shoes after you liked a "Hiking Group" or the opportunity to bet on your favourite football team after liking the "Manchester United Page". Combined with all the information you pump into Google search on a daily basis, it is reasonable to assume that nearly every aspect of your life is being packaged, used and sold to marketing companies for profit.

Freedom Isn't Free

In order to continue to receive services like Facebook and Google for no free, the use of our personal data seems to be a price users are forced to pay as companies that do not produce any actual products seek profitability. But are a few targeted ads an acceptable price to pay for access to the largest library of knowledge and communal space in human existence? Without the ability to sell us products and services using our personal information, users would be faced with either being confronted with a scatter-gun approach to advertising or having to pay a fee- as for Netflix- for traditionally free services such as search engines and social media. By using our personal data, companies can argue that they are giving us a better customer experience and keeping the internet largely free at point of entry. The inherent concept of our personal sentiments and interests being used to increase up-selling opportunities is one that many people will find distasteful and would prefer not to participate in, despite the possibility of a change in the way they can make purchases, as they feel their data is being used without their consent and is a violation of privacy. However, it is worth remembering that monetisation of customer data is as old as the grocery store loyalty card and hardly a new invention of the internet; the only difference being that we notice the advertising online as we use it almost constantly, as compared to just once a week at a grocery store.

"Customer information has always been central to any CRM strategy, but the growing wealth of information from digital channels - from social media, location and context-sensitive data collected from mobile, and the Internet of Things (IoT) - radically expands the scope of the 360-degree customer profile," said Ms. Huang, research director at Gartner.

By 2020 there will be an estimated 50 billion devices connected to the internet, largely thanks to the Internet of Things (IoT) that aims to electronically connect everything from your mobile phone, exercise band and computer, to your kettle, fridge and thermostat. With so many devices connected to the IoT, the data being stored and recorded is expected to grow exponentially, eventually being 44 times larger in 2020 than it was in 2009. The IoT also presents another, darker danger for users than targeted advertising. ForeScout analysis has highlighted the dangers posed by these devices and how most can be hacked in under 3 minutes and provide simple points of entry to personal and business networks.

What Exactly is Personal Data?

Personal data can be broken up into three distinct categories:

Volunteered data: Content which is created and shared by individuals, including their social media profile data, such as what music and movies they like, football teams they support and general interests.

Observed data: This information is captured by recording the actions of the consumer/individual, such as where they live, their socio-economic status and if they are married or single.

Inferred data: This category is the one with the most practical value. Using the first two types of data brands can work out your sex, age, sexual orientation, interests, employment status, hobbies etc. Using this information allows them to pre-empt your interests and offer you goods and services that would fit in the "box" of the specific person that they are targeting.

As much as consumers may want to opt-out of this type of data-mining and targeted marketing, many do not know or even realise what and when data is being collected about them, or by whom. The truth is that the internet as we know it has been built on this agreement between user and provider and should either exploit and retract their position too much, the whole infrastructure could come tumbling down.

A Wealth of Riches

Despite the delicate balance between consumers and companies, the sheer value and scope of the data available will force change in the near future. In a 2011 World Economic Forum, it was theorised that personal data will become a new "asset class" and would become one of the most valuable resources on the planet. The big companies that control this data will become so powerful and so rich that they will be forced to protect and build on their resources, locking customers into their services by any means possible in order to maintain their position.

How Much is My Personal Data Actually Worth?

With trillions of pieces of information being generated, there comes another issue; that being for the most part, the information is not vetted. Big data and targeted marketing work on low cost and high reward. The cost of vetting would remove much, if not all of the profit margin that creates the vast amount of company profits and revenue for companies like Facebook and Google. Given the lack of vetting it is quite common for a 30-year-old single man with no children to suddenly have adverts for push-chairs, schools, nappies and cribs follow him around the internet after researching and purchasing a baby themed item for his sister's new baby. These kind of errors are all too common and will be familiar with many people who have ever used the internet.

But despite these problems, big data and targeted marketing continue to grow and thrive. Data is now a $300 billion-a-year industry and employs 3 million people in the USA alone while in the UK £10 billion a year is generated in digital advertising income for publishers and content creators. As consumers use of the internet continues to grow and evolve from a useful tool to an essential part of everyone's lives, businesses will evolve along with it and will market and sell to us more and more on us as individuals, rather than spending fortunes on big all-encompassing advertising projects.

The Future of the Internet

We are now in the cross-over period in the history of the internet. Up to now it has largely been free to use and relied on people either being happy to give over their personal information or not caring or knowing enough about it to prevent it. With the increasing business costs and potential money to be made, it's likely that in the near future things could be somewhat different. In the future, data will power everything and be the most valuable commodity in the world. As such, governments are going to get involved and regulate and control every aspect of the world wide web completely, including companies' ability to harvest it and use it for their own financial gain. The situation will either see personal data being treated as confidential information that cannot be accessed by outside agencies (such as personal medical data is now) or Governments will demand a sizable cut, forcing big internet companies to diversify their revenue stream in order to increase profiles: i.e. charging for "free" services.

This could then present a class system of internet users, with the best and most useful websites only available to those with who can afford them. This will leave the poor and less advanced societies unable to access the "A-Grade web" and forced to root around in bargain basement webpages and access questionable and hacked content that could be full of bugs and viruses.

Hints of the potential for digital catastrophe are peppered around the world already. As the New York Times noted, a recent Pew Research report on the likely nature of the internet a decade from now contained the word "threat" more than four times as often as the word "hope". Whatever the future of the internet and the use and exploitation of personal data holds for both consumers and companies, the next 10-15 years will likely see a big change in many different aspects, from encroaching personal targeted data advertising, to a segregated internet that gives different levels of service to those who can afford it.

At CBS we will never sell or abuse the personal data we receive such as emails addresses, company information and financial status that is provided to us by clients. We believe in providing a confidential and secure service that benefits everyone involved and will continue to maintain the highest standards in keeping personal data out of the hands of those who would exploit it.

For further information on background screening, please contact our team who will be able to help guide you through the process of conducting background checks.

Tel: 01443 799 900

Email: info@cbscreening.co.uk

website: http://CBScreening.co.uk

back to news

# data[].attributes.attachment_link.title
Your Personal Data and How Companies Use It

# data[].attributes.attachment_link.description
In 2017 we live in a digital age where more data is being created and captured in every aspect of our daily lives than any other point in history. CBS, like many businesses receives thousands of pieces of personal information from our customers when they register their details with us.

# data[].attributes.body
Main idea:

Arguments/facts:
-
-
-
-

Dialogue:

Summary:

APA

# data[].attributes.attachment_link.description
In this day in age, we have a DIGITAL FOOTPRINT. Your digital footprint is the portion of data that lingers around the internet. Some of it is data you have personally shared, the rest is data other people have shared. We live in a world where someone is googling you all the time.

# data[].attributes.body
Main idea: Why Would Someone Steal My Data?

Arguments/facts:
-Bosses rank data theft as one of the biggest security threats
-Data theft can also be an unintentional act
-Cybercriminals can lurk inside networks, pretending to be a legitimate user for days, weeks, or years.
-If not detected, they can pose a growing threat to an unaware business.

Dialogue:

Summary:

APA

# data[].attributes.attachment_link.description
Okta’s complete guide on data theft. Everything you need to know about the impact of corporate and employee data theft, and tips for data theft prevention.

# data[].attributes.body
Main idea:

Arguments/facts:
-
-
-
-

Dialogue:

Summary:

APA

# data[].attributes.attachment_link.title
WHO Owns Your Data? (+ how to steal it back)

# data[].attributes.body
Main idea:
Most companies access insane amounts of personal data without us even realizing it.
Arguments/facts:
-When clicking ‘accept’ on a cookie pop-up without reading any of the information just so we can see a website sooner we are most likely giving out data.
-The world’s biggest brands can potentially access and track to discover who knows the most about us.
-Websites can collect usual data like your name, age and more but they can also collect very unusual things such as your pet's age for example.
-Some want to capture your personal appearance by using things like image and voice recognition.

Dialogue:
Websites might want many unexpected things from us and we are just giving them away especially for laziness and lack of care.

Summary:
Most websites retrieve personal data from us and even if we may think that the bigger ones are safe because everyone uses them they are still accessing your data with your permission even though you might not even know. Giving websites access to your data is extremely easy and fast since it can be done by a simple click on access microphone for example which would actually enable the website or app to listen to everything you say when you're round your phone to then affect future add pop-ups.

APA
Slynchuk, A. (2022, November 29). Big Brother Brands Report: Which Companies Access Our Personal Data the Most? Clairo Blog. Retrieved January 31, 2023, from https://clario.co/blog/which-company-uses-most-data/

# data[].attributes.attachment_link.title
Which Company Uses the Most of Your Data?

# data[].attributes.attachment_link.description
We analysed what personal data the world's biggest brands are tracking to discover which company knows the most about us. What brands are using weird and wonderful pieces of information to target you? We thought we'd find out.