What happens to your data after a breach?

Data is the most valuable resource in the modern world. For several years now, the businesses that we use have routinely asked us to hand over increasing amounts of personal data: from our IP addresses to our names and credit card numbers.

Widespread complacency amongst consumers means that we all too often hand over this data without a second thought. Despite frequent instances of businesses suffering a catastrophic data breach that expose personal information to the wider world.

When a data breach occurs, it is hugely embarrassing for the business concerned but most consumers don’t think about it again. However, while it might only happen to a small percentage of those exposed in a data breach, identity theft and frauds do occur as a result of data leaks and breaches.

Even the biggest and most well-funded businesses fall victim to data breaches now and then. It’s almost certain that at least one of the many businesses that you share data with will be hit by a data leak.

It is, therefore, important that you know what to do if a business that you use suffers theft or leak of data.

High profile data breaches

The nature and definition of high-profile data breaches have changed considerably in recent years. When Sony suffered a serious data breach in 2011 that affected 77 million PlayStation Network users, it was a virtually unprecedented event. Fast forward nearly 10 years, and there have been multiple breaches in that time that have affected hundreds of millions of users.

For example, in 2017, Equifax suffered a serious high-profile data breach that resulted in 140 million people having their personal data exposed. This was a significant and much-publicized case, and it caused enormous damage to Equifax’s reputation. However, it pales in comparison to Yahoo, who was hit by the largest data breach in history and didn’t notice for years. The search giant eventually admitted that around three billion user accounts had been compromised in an attack believed to have had state backing.

These are just some of the data breaches that make the news. Every day, small and medium-sized businesses that most of us have never heard of are having their user data harvested and sold on. Many of them don’t even realize that they have been hit.

Where does that data go?

While just about every business that we use today wants some form of data from us, different businesses request different data. Whenever a data breach occurs, one of the first things that victim businesses need to do is to identify exactly what data has been compromised and what form it is in. Sensitive data that is stored unencrypted in plain text represents a very serious security risk for users. If sensitive information is properly encrypted, hashed, and salted, it will be of little use to anyone who is able to steal it.

In some cases, the data leaked from a single source can be enough to impersonate someone, hijack their online accounts, and generally wreak havoc in their life. However, the chances of all the necessary information that criminals need being obtained from a single breach are slim. Instead, cybercriminals and fraudsters will usually cross-reference information gleaned from numerous data breaches.

In fact, if you know how to navigate the dark web then it is remarkably easy to find these databases of personal information for sale online. These custom databases gather together all the data from numerous different breaches and package it together in an easily searchable format for fraudsters to use. By combining information from a number of sources and identifying which pieces of information belong to particular individuals, fraudsters can cause much more damage than any individual breach would enable them to.

As well as being sold on the dark web’s black markets, stolen login credentials are also posted to specialist forums that are frequented by fraudsters and scammers. In many cases, hackers will post a small selection of the data they have obtained as a taster to convince people to buy more data from them.

What to do after a data breach

If a business that you use is hit by a data breach, you shouldn’t wait until someone steals your identity before you take any action. There are numerous things you can do to reduce the chances of a data breach coming back to bite you. First and foremost, if you are using the same password for the breached service elsewhere, you should change your passwords straight away – this is why we are always being told not to reuse passwords.

You can use the fantastic online tool haveibeenpwned.com to see whether any of the login credentials that you use have been compromised. Remember, it only takes one service being lax with their security to compromise numerous accounts that you control.

You should pay close attention to updates released by the affected business. They will be legally obligated to disclose certain details about what has happened to the public. Businesses don’t always have the best track record when it comes to transparency and honesty in the wake of a data breach, but only they and the hackers will know the true scale of any individual breach.

Many businesses offer free identity and fraud protection or insurance to users whose data is leaked or stolen. This is always worth taking advantage of. Even if the individual breach that you are aware of doesn’t seem threatening, it could lead to other accounts and data becoming compromised.

Data breaches are an inevitable part of the modern world. As long as the businesses and services that we use every day are gathering and storing huge volumes of personal data, they will be tempting targets for criminals. Always assume the worst when your data is exposed in a breach or leak – you can never be too careful or vigilant when it comes to identity theft.