robintek

You’ve probably heard the term “data breach,” but do you really understand what it is? Make time now to learn more details about a data breach, including what you can do to protect yourself.

Data Breach Defined

A data breach, data leak or data spill is defined as an incident when protected, sensitive or confidential data is viewed, used or stolen by someone who does not have authority to access that data.

The term typically describes a breach that occurs online over the internet. However, it also includes laptop thefts or reading physical files.

During a breach, affected data can include:

• Non-sensitive or sensitive personally identifiable information (PII) – address, age, or Social Security number
• Personal health information (PHI) – medical history, lab test results and insurance information
• Intellectual property
• Trade secrets

How Does a Data Breach Occur?

Anyone can be affected by a data breach, and it can happen in several ways.

1. Thieves intercept unencrypted data.
2. Hackers gain access to files over weak or unsecured computer networks.
3. Someone with access to personal information sells it to thieves.
4. Your laptop, smartphone or other electronic device is misplaced or stolen.
5. A hacker gathers the personal data you share over unsecured websites.
6. Phishing schemes entice you to share your data with criminals.
7. You send sensitive information through social media.
8. Physical files or hard copies of information are stolen.
9. Someone videotapes an employee who enters data into the computer.

What Happens After a Data Breach?

When your data is used, viewed or stolen, it can affect you in several ways.

• The criminal could access your financial accounts.
• Someone could impersonate you and open credit accounts or apply for car, house or personal loans in your name.
• The thief could log into your work account and gather secret information about your company.

Protection from a Data Breach

Numerous regulations dictate how employers, medical providers and others can use your data. For example, the Health Insurance Portability and Accountability Act (HIPAA) regulates access to your PHI, and the Payment Card Industry Data Security Standard defines who can access and use your sensitive PII.

These protections aren’t always enough, though. You should also take several steps to protect your data.

• Secure your devices with passwords.
• Use a different and challenging password for each log-in.
• Encrypt sensitive personal and work data.
• Share personal information, including your credit card number, on secure sites.
• Do not open links from untrusted sources.
• Update software often.
• Subscribe to a data breach monitoring service.
• Purchase cyber liability insurance

A data breach can affect your life now and well into the future. Take steps today to protect yourself.

Identity theft affects over 17 million people every year reports the Bureau of Justice Statistics. While you hope it doesn’t happen to you, these steps can help you take action if you are an identity theft victim.

Take action immediately.

As soon as you think your identity is stolen, take action. The situation will only get worse if you wait to correct it.

Create a log.

In a notebook or on your phone, create a log that tracks every phone call, letter or email you send. Record the dates and times of the communication and the person to whom you speak. You’ll need this record to prove that you’re taking action to address the identity theft.

Contact the three credit bureaus.

Ask the three credit bureaus to put a fraud alert on your accounts.

• Equifax: 866-349-5191 www.equifax.com
• Experian: 888-397-3742 www.experian.com
• TransUnion: 888-909-8872 www.transunion.com

Review your credit reports.

Check your credit reports carefully. Verify that your personal information is correct then look for any inquiries, open accounts or delinquencies that you did not initiate. Report suspicious activity to the credit bureau immediately.

File a Federal Trade Commission report.

When you report identity theft to the FTC at www.identitytheft.gov or 1-877-ID-THEFT (438-4338), you receive a personalized guide that helps you recover your identity. They also provide you with important forms for creditors and the police.

File a police report.

Identity theft is a crime, so report it to the police. Provide as much evidence of the theft as you can, and keep a copy of the police report to show your creditors.

Contact other organizations if necessary.

If you think your Social Security number or passport is compromised, contact the appropriate organizations.

• Social Security Administration www.oig.ssa.gov 800-269-0271
• U.S. State Department www.travel.state.gov 877-487-2778

Close compromised accounts.

Scan your bank and credit card statements, including dormant accounts, for suspicious or fraudulent activity. Alert the financial institution right away if you spot problems, and ask them to lock or close your account.

Open new accounts.

You must continue to pay bills after your identity is stolen, so open new bank and credit card accounts. For each account, choose unique PINs and passwords.

Deal with debt collectors.

You may receive notices from debt collectors about outstanding bills. Call them and send a letter that indicates you are an identity theft victim and not responsible for unpaid bills. Include any related documentation, such as the police report. Ask the debt collector to confirm in writing when the collection account is closed.

Identity theft is challenging to handle and disrupts your life. If you’re a victim, take these steps.

The federal Internet Crime Complaint Center received more than 330,000 complaints in 2009, and more than a third of them ended up in the hands of law enforcement. The damages from those referred to the authorities totaled more than a half billion dollars. The Government Accountability Office estimated that cyber crime cost U.S. organizations $67.2 billion in 2005; that number has likely increased since then.

With so much of business today done electronically, organizations of all types are highly vulnerable to theft and corruption of their data. It is important for them to identify their loss exposures, possible loss scenarios, and prepare for them.

Some of the questions they should ask include:

What types of property are vulnerable? 

The organization should consider property it owns, leases, or property of others it has in its custody.

Some examples:

• Money, both the organization’s own funds and those it holds as a fiduciary for someone else
• Customer or member lists containing personally identifiable information, account numbers, cell phone numbers, and other non-public information
• Personnel records
• Medical insurance records
• Bank account information
• Confidential memos and spreadsheets
• E-mail
• Software stored on web servers

Different types of property will be susceptible to various threats, such as embezzlement, extortion, viruses, and theft.

What loss scenarios could occur?

The organization needs to prepare for events such as:

• A fire destroys large portions of the computer network, including the servers. Operations cease until the servers can be replaced and reloaded with data.
• A computer virus infects a workstation. The user of that computer unknowingly spreads it to everyone in his workgroup, crippling the department during one of the year’s peak periods.
• The accounting department discovers a pattern of irregular small funds transfers to an account no one has ever heard of. The transfers, which have been occurring for almost three months, were small enough to avoid attracting attention. They total more than $10,000.
• A vendor’s employee strikes up a casual conversation at a worker’s cubicle and stays long enough to memorize the worker’s computer password, written on a post-it note stuck to her monitor. Two weeks later, technology staff discovers that an offsite computer has accessed the human resources database and viewed Social Security numbers, driver’s license numbers, and other personal information.

In addition to taking steps to prevent these things from happening, the organization should consider buying a Cyber insurance policy. Several insurance companies now offer this coverage; although no standard policy exists yet, the policies share some common features. They usually cover property or data damage or destruction, data protection and recovery, loss of income when a business must suspend operations due to data loss, extra expenses necessary to maintain operations following a data event, data theft, and extortion.

However, each company might define these coverages differently, so reviewing the terms and conditions of a particular policy is crucial. Choosing an appropriate amount of insurance is difficult because there is no easy way to measure the exposure in advance. Consultation with the organization’s technology department, insurance agent and insurance company might be helpful.

Finally, all policies will carry a deductible; the organization should select a deductible level that it can afford to pay and that will provide it with a meaningful discount on the premium. Once management has a thorough understanding of the coverages various policies provide in relation to the organization’s exposures, it can fairly compare the costs of the policies and make an informed choice.

Computer networks are a necessary part of any organization’s environment today. Loss prevention and reduction techniques, coupled with sound insurance protection at a reasonable cost, will enable an organization to get through a cyber loss event.