How can businesses avoid data breach blind spots?

Data breaches require considerable time and resources to resolve. The damage can be extensive, from financial costs and operational downtime to untold reputational harm, while the shift to remote working has exposed new vulnerabilities too.

With such wide-ranging consequences it pays to be prepared but according to latest Experian research, only 19% of firms strongly agreed they were prepared to respond to a data breach caused by their remote workforce.

Even businesses that believe they are well prepared are likely to have blind spots. They underestimate the difficulty of recovering from a breach, the complexity of notifying customers, managing communication channels, notifying regulators, and executing a raft of essential decisions to mitigate risks and minimise business impact.

Organisations tend to focus on prevention – investing in IT systems and software to minimise the risk of an attack. But few go further and prepare for the response required should a breach occur. Cyber-attacks can happen at any time to any business of any size.

Businesses also face so many competing priorities, and particularly in the Covid-19 era, it can be difficult to find the time and resources to dedicate to data breach response planning.

Why prepare for a data breach?

Preparing for a data breach means you are ready to respond immediately.

Your business will have a greater appreciation of the decisions that need to be made. Many of these – and the thinking behind them – can be done in advance. That will take the pressure off when you’re in a stressful post-breach situation. You will know who to consult – from legal and insurance teams to crisis PR and response specialists – and how to report to regulators.

You can prepare essential customer or employee communications in advance too. You can plan what to say to different types of customers or employees, in different situations, and get your communication templates ready.

Preparation involves having contact centre resources on standby to be deployed when needed. Communicating accurately and comprehensively with anyone impacted by the breach is one of the critical elements and avoids drip-feeding of information that may cause anxiety and erode trust.

You need to be prepared to handle inbound queries from customers or employees too. If you are unable to resource, respond promptly and confidently to queries, this can create bigger challenges and further damage your reputation.

What steps should businesses take now?

The first step is to examine the data you hold on customers and employees. Under GDPR, the minimum you must do is notify data subjects if they are deemed to be at high risk of identity theft, as well as notifying the regulator.  

Next, think about how you would communicate with anyone affected by a data breach. How easy would it be to inform everyone concerned? Think about the different ways you need to communicate with different types of people. What contact details do you hold and what communication channels should you use? Do you have the resources in place to implement this type of mass communication?

Consider how you would respond to different types of attacks. Your response strategy for a ransomware attack will be quite different to your response to data lost through laptop theft, for example. Do you need to categorise risk based on different levels of data loss?

The scenarios can become complex. The more thoroughly you examine these scenarios and plan your response, the better your deployment strategies will be for different eventualities.

Preparation brings peace of mind

Having these conversations with specialists in advance, outside the heat of a crisis situation, is reassuring for businesses. Working with the right legal, IT forensics, crisis communications and consumer-response specialists will ensure you cover your blind spots, prepare thoroughly for any breach, and have the right resources in place to react effectively if the worst happens and minimise the impact on both businesses and customers.