The recent data breach at Odido, in which personal data of millions of customers ended up in the hands of criminals, once again shows how vulnerable organizations can be. Data leaks often occur unexpectedly and even well-protected organizations can face them.
In the event of a data breach like this, it is essential that the affected organization act as quickly as possible and take appropriate steps to mitigate the damage. The Personal Data Authority has established a procedure for such cases. In this article, we explain step by step what measures should be taken once a data breach is discovered
What exactly happened?
First, it is important to find out what type of data breach has affected your organization. The Personal Data Authority describes the following types:
- A breach of confidentiality: An (unauthorized) person has, whether accidentally or not, accessed personal data or made it public.
- Violation of integrity: An (unauthorized) person has, whether accidentally or not, made changes to personal data.
- Violation of availability: An (unauthorized) person has, whether by accident or not, destroyed personal data or blocked the organization's access to the data.
Once you have figured out what type the data breach falls under, there are a number of questions you need to answer to gain a deeper understanding of the data breach. The complete list can be found in dit article From the Personal Data Authority, this includes questions such as: “What is the cause?â€, “When did the data breach occur?†And “What type of personal data was leaked?†The type of data breach that occurred at Odido is not yet known.
What measures should you take?
When you understand the situation, it is time to take appropriate measures. An incident response plan is crucial at this step. Such a plan operationalizes article 32 AVG by establishing in advance what actions should be taken to mitigate further damage, assess risks, meet reporting obligations and prevent recurrence. Without such a plan, there is delay, lack of clarity and increased risk of further personal data breaches. Stopping the data breach, if ongoing, should always be the top priority. Other measures may vary by situation. A Security Officer or CISO can help you create an Incident Response Plan. In the event of a data breach due to a cyber attack, organizations are expected to seek the help of a forensic expert because of the complexity of such attacks.
What are the risks for the victims?
Organizations are expected to make risk assessments for victims. When the data can be used for identity fraud, phishing, you are required to inform the victims. In the case of Odido, this is also the case, they say they will inform the victims within 48 hours. For now, they advise customers to be extra vigilant for suspicious contact attempts.
When informing victims, it is important to explain quickly, clearly and understandably what happened, what data was leaked and the potential consequences. Give specific advice on how they can protect themselves and describe what measures your organization is taking to plug the leak and prevent a recurrence. Also include a contact point for victims to ask questions.
Should the data breach be reported?
In almost all cases, the data breach must be reported to De Autoriteit Persoonsgegevens within 72 hours. They will give you further information about the data breach and how you can limit damage when reported. The data breach does not need to be reported if it has no negative consequences for the victims. However, this almost never occurs.
Want more information on how to guard against a data breach? Contact us.
Source: Hack at Odido, data of millions of customers in hands of criminals
Source: Data breach? Here's what you need to do | Personal Data Authority