The CNIL (the French Data Protection Authority) received 742 notifications of personal data breaches (and see the original report in French) that affected over 33 million individuals located in France or elsewhere. 695 related to confidentiality breaches.

The accommodation and food services sector had the highest number of breaches – 185. This is due to a specific case where a booking service provider was affected by a data breach.

Cause of the breaches

Hacking via malicious software or phishing	421 (63%)
Data sent to the wrong recipients	62 (9%)
Lost or stolen devices	47 (7%)
Unintentional publication of information	43 (6%)
Unknown cause	99 (15%)

It should be noted that the figures given don’t add up to the 742 notifications and the causes are not known in all cases. But where the causes are known one view is that that the ‘Human factor’ is an underlying concern – links in phishing emails don’t click themselves  – and not having robust information security measures in place – training, checking who emails are going to etc – increases the risk of data breaches.

Actions you should be taking

The key actions:

• Train staff on a regular basis on how to spot possible social engineering attacks, to  not click links or attached files on suspicious emails ‘to see what happens’ and to check who they are sending email to
• Apply software patches when they come out
• Use multi-factor authentication to reduce the risk of unauthorised logins
• Use anti-malware measures on endpoints

If you want an independent audit on the effectiveness of the measures you currently in place, help with training and getting a culture that has information security and data privacy in its core principles, or are considering ISO27001 certification as one of the ways to meet security requirements expected by customers and suppliers, please get in touch.

e: ian.grey@wadiff-consulting.co.uk
t: +44 (0)7941 188462