Data breaches can have serious consequences for individuals and businesses. They can result in compromised personal information, financial losses, and reputational damage.

It is therefore crucial to put measures in place to protect against the theft or accidental leakage of data. It is also essential to prepare a data breach response strategy so that in the event of a breach, losses are mitigated.

In the second of our cybersecurity blog series, we’ll be looking at:

• Why do I need to be concerned about data breaches?
• How can data be leaked?
• What are the financial implications of data breaches?
• Why do I need a data breach response plan and what should it cover?
• How will cyber insurance help in managing data breaches?

Why do I need to be concerned about data breaches?

UK organisations lost billions to data breaches between 2019 and 2022, with hundreds of millions of customers suffering a compromise of their personal information.

Regulatory fines and legal costs accounted for a proportion of the billions lost, but dropped business and reputational damage by far represented the most significant losses.

How can data be leaked?

Data can be stolen through cyberattacks such as ransomware, phishing or viruses.

It can also be leaked through internal sabotage, or comprised via device theft.

Social engineering – where someone is manipulated to share information they shouldn’t – is another common way data can be compromised.

Finally, human error accounts for a large proportion of data breaches. Common issues include password sharing, emails sent to the wrong recipient, and misplaced devices.

What are the financial implications of data breaches?

The financial implications of data breaches are very serious:

Regulatory penalties – organisations found in breach of data protection legislation can be fined up to £17.5 million, or 4% of annual global turnover, whichever is highest.

Civil claims – customers impacted by a data breach have the right to take legal action against the organisation, including both material (e.g. financial) and non-material (e.g. emotional distress) damages.

Reputational damage – loss of customers, sales and income over time account for a large proportion of financial losses following a data breach.

Personal action – in some data breach cases, directors, consultants and staff can be held personally liable for mishandling sensitive data.

Why do I need a data breach response plan and what should it cover?

A data breach response plan is a proactive measure you can take to mitigate the risks, repercussions and damages associated with data loss situations.

A good data breach response plan should include:

1. Containment Strategy

Much like stemming a water leak, the aim of your containment strategy is to isolate the breach and prevent it from doing any more harm.

• Contact any retained or in-house IT or cybersecurity consultants immediately to put emergency containment measures in place and check for other vulnerabilities.

• Use cyber intrusion detection and protection systems and endpoint security to proactively alert you to unauthorised access and unusual activities.

• Train staff to identify potential breaches, and stress the importance of swift action to contain the breach and assess its scope.

2. Damage Assessment

Once the breach is contained, your next step is to assess the damage.

Ask these questions:

• What type of data was affected by the breach?
• How much data was impacted?
• Who was affected by the breach?

This information-gathering stage will provide an understanding of the impact of the data breach, giving you a better idea of what needs to be done to resolve the issues.

3. Notification Procedures

Your response plan should set out steps for notifying:

Affected parties – for example customers, employees, consultants and suppliers. This is vital, as those affected may need to take urgent steps to protect themselves, such as cancelling credit cards and changing passwords.

Your cybersecurity insurance provider – usually your first port of call if you have data breach helpline cover, as they will provide clear instructions on your crucial first steps. 

Regulatory agencies – as well as being legally required to inform the Information Commissioner’s Office (ICO) of a data breach, you may be bound by other industry-related regulatory procedures. Failure to notify the relevant parties could result in legal action, significant fines and, sometimes, criminal charges.

Legal and compliance teams – they will advise you on who to notify, and guide you on your response and reactive measures, making sure they comply with applicable laws and regulations.

Include clear instructions in your response plan for timely and transparent communication to maintain trust and credibility. Provide advice for managing public relations during and after a data breach. If you use a PR agency, put them on your notification list.

4. Investigation Process

This part of the response plan involves digging deeper into how the breach occurred, what data was affected and who was impacted.

Work closely with your IT and cybersecurity advisers and management teams to:

• Gather evidence of the breach and how it happened
• Evaluate systems and resources that may have been compromised
• Ascertain the extent of who was affected and how they were affected

Information gathered during this step will be crucial to repairing systems and putting robust processes in place to prevent similar incidents in the future.

5. Remediation Measures

Once the investigation is complete, it’s time to repair any damage and reduce the risk of repeat issues.

Your goal is to restore everything to a safer position than it was before the breach. This may include:

• Putting additional data security policies, procedures and practices in place
• Implementing staff training or reviewing existing training programmes
• Investing in or upscaling existing cybersecurity measures

If you do not already have it, consider investing in cyber insurance to further protect you against any future data breaches or cyberattacks.

How will cyber insurance help with data breaches?

Cyber insurance is a valuable tool for mitigating the financial risks associated with data breaches.

The costs of a data breach can be crippling. Legal fees, notification costs and forensic investigations all add up. Added to business interruption expenses and potential regulatory fines, the effects can be devastating.

Cyber insurance covers direct financial losses resulting from cyber events, including data breaches.

Depending on the individual policy, cyber insurance policies may cover:

• Pre-incident support – advice on reducing the risk of a cyber event

• Security and privacy breach costs – notification and communications management costs, forensic IT costs, legal fees, civil claims and legal and regulatory defence costs

• Post-incident support – some policies offer a 24/7 helpline, forensic IT experts, identity fraud and credit monitoring services, communications and reputation management guidance and advice on legal and regulatory obligations.

• Cyber extortion cover – protection in the event of ransomware and other malicious attacks.

• Damage to digital assets – covering the costs for the loss, corruption or alteration of data or the misuse of computer programs and systems.

• Business interruption – cover for loss of income during the period of interruption, plus additional costs in keeping the business running in the aftermath of an incident.

• Liability costs – costs for defending claims for libel, slander, defamation or intellectual property infringement, as well as compensation for affected parties.

Protecting you against modern business risks

Data breaches are becoming part and parcel of everyday business life. It’s therefore vital to have a data breach strategy in place to mitigate the effects of any such event.

In addition, we strongly recommend cyber insurance to protect against the financial impact of data breaches and cyberattacks. The cover is surprisingly affordable, and there are policies specifically suited to smaller businesses and sole traders.

For advice on protecting against data breaches and cybercrime with insurance cover tailored to your specific needs, we welcome you to get in touch  with our dedicated cyber protection team.