A breach in data security can be costly in several ways regardless of the size of your business.
Data security breaches and hacking incidents continue to make headlines and the threat to businesses will not go away. Preventative measures may seem costly both financially and time-consuming, but these can be far less than ignoring the potential risks and inevitable outcomes.
Let’s look at what these potential costs are and answer a simple question – can your business afford to ignore the risks?
The cost of a Ransomware Attack
Ransomware as the name suggests is an intruder to your data who is holding it or access to it for a ransom. According to a recent SOPHOS report, the average ransom paid globally was £170,000. The most common payment was $10,000 in 2021 while the highest was $3.2 million. Of those who paid the ransom in 2021, only 8% managed to get all their data back.
Whether an organisation chooses to pay the ransom or not, there are still remediation costs including lost order, recovery, business downtime and operational costs to name a few before your business can be back up and running. Organisations who already have a robust recovery plan for such incidents such as back ups and similar processes can take days or even weeks to fully recover.
How costly would a total loss of data with days or even weeks not being able to operate be to your business?
Costs of Data Security Investigation
Should any data security breach occur, it is a requirement that this is reported to the ICO. Every organisation since the introduction of GDPR in 2018 must have at least one appointed Data Controller. The number of controllers will depend on the scale and format of your organisation but will be underpinned by one key overseer. It would normally be their role to follow protocols to inform relevant authorities of such incidents.
Depending on the scale and nature of the data security breach, this may not only be an ICO matter but one for the police as well.
Investigations into any such breach not only look at the incident itself, but also the situation within the organisation and its approach to data security before, leading up to and following the incident. There are several key areas that can be explored from how your data is stored, access and even training of those who may encounter any data. Contact with data can range from those handling broad levels of information including customer, employee, or other extensive data, through to the single call handler taking messages or referring calls.
Typical investigations will look at the following:
- How data is stored and secured
- Any tools and resources in place to protect the data (firewalls, anti-virus, server access)
- Staff training
- Source of the breach
- Results of the breach
- Details around the reporting of the breach (how quickly found, declared, and resolved)
- And many more
Cyber Essentials accreditation is now widely recognised in the UK as the benchmark for data security best practice. Seeking certification can help identify all your organisation can do to be best protected, how to maintain a high level of data security and as a recognised classification, can mean greater opportunities when bidding for projects such as for public sector organisations.
The investigation can take time and money to explore until the date of verdict. It is likely not only would this impact your organisation and its resources directly, but there are also likely additional legal representation costs too. Should the investigation find fault by the organisation, there are potential penalties.
What are the potential penalties from ICO?
Following the investigation findings, the ICO has the power to issue instructions and even monetary penalties for infringements. Such penalties are determined on a case-by-case basis, and intended to be effective, proportionate, and dissuasive.
There are two tiers of penalty – higher maximum and standard maximum.
What is the Higher Maximum ICO penalty?
The Higher Maximum amount possible is £17.5 million or 4% of total worldwide annual turnover in the preceding financial year, whichever is higher. This can apply to any failure to comply with any of the data protection principles, any rights an individual may have under Part 3 of the act or in relation to any transfers of data to third countries.
What is the Standard Maximum ICO penalty?
For other infringements such as administrative requirements, the standard maximum amount applies. The value is £8.7 million or 2% of the total worldwide annual turnover in the preceding financial year, whichever is higher.
The Rise in Compensation
Following the increase in data security incidents relating to personal records and broader legal proceedings, have become more widely publicised as legal firms and individuals act when such breaches of personal information occur.
A recent campaign by one legal firm against a single company is reaching out to current and previous employees of the business following a substantial data breach which has been shown to have been most affected against its personnel records. Though the ICO investigation is still ongoing around the breach and therefore cannot be determined if the breach was due to what can be deemed a “failure by the organisation”, this has not prevented the legal firm taking early steps to seek those potentially affected.
The case appears to focus on the sale of personal information illegally obtained during the breach to seek if such sale and potential identity theft or fraud has or will occur.
Such cases are not yet widely publicised in terms of results and benchmark compensation amounts, however due to the scale of approach it appears there is an appetite to pursue such claims by legal firms and if successful, can mean further substantial costs to businesses impacted by such breaches.
What can you do?
Data security risks are anticipated to continue to rise and as time and technologies move forward, continued efforts for prevention and lessons are likely.
Lessons from recent years particularly following the impacts of GDPR and data protection legislation show though the risks remain consistently high, actions can be taken and that the level of action and awareness can have the greatest effect. Failing to have sufficient, recognised preventative measures and practices in place along with ineffective actions should such incidents occur are almost certain to have negative results.
The ICO investigative approach and past rulings illustrate the expectations of the scale of preventative measures undertaken by organisations and their actions following any data incident will determine their verdicts. Such investigations and rulings will apply to any size organisation. If your business handles any kind of data, the same laws and penalties apply.
Understanding what you should be doing as a business and how to approach data security may seem daunting but there are tools that can help.
Cyber Essentials certification offers a clear outline of steps and best practice guidelines when approaching data protection for your organisation. Accreditation is recognised across industries and is an expectation of businesses working or seeking to work with public sector organisations. By meeting all elements of the Cyber Essentials certification assessment, it can ensure all viable methods of prevention, policies and practices should an attempt or incident occur are in place and recognisable by ICO investigations.
Ensuring your business has the right tools and policies in place may take time and require some investment but is achievable. Cyber security tools and easy to follow ways of working is nothing new but there are a range of resources accessible in domestic and professional formats. Professional level software tools are more suitable for businesses and can offer efficiencies alongside more security features.
Read our online safety top tips for more advice on how to be safer at home and work.
Information Solutions can offer advice and a range of services that can help your organisation improve its approach to data security including helping to achieve Cyber Essentials certification. Speak to our team for a consultation and discover our range of solutions we can provide your business.