In the first half of 2017, more data was stolen than in all of 2016. But is this really surprising? The 918 security breaches registered by Gemalto’s Breach Level Index led to the theft of almost 2 billion records, which is 164% more than the figures for the whole of last year. And unless we implement the appropriate security measures, the situation does not seem to promise much improvement.

122 records affected every second, most by accident

In a time when privacy and data security have once again become a topic of debate in the business environment, the magnitude of these figures would amount to 122 data records at risk per second. From medical information to credit cards, through access credentials.

Although when talking about security breaches the first thing that usually comes to mind are attacks perpetrated by cybercriminals, it is important to focus on internal threats and oversights in the company’s own security. While it is true that malicious attacks from outside the organization are the main cause of security incidents (74% of the 918 registered cases), there is a worrisome 26% of security breaches that originate internally or can be chalked up to an accident. In hundreds of incidents the problem lies in the cybersecurity tools themselves and the procedures established to protect the company’s information.

Accidental data leaks, due to simple negligence, have reached a disproportionately large number in 2017. Although accidents are behind 18% of security incidents, they have exposed over 1.6 billion records, an alarming 86% of the total. This high figure is mainly due to data leaks compiled by River City Media, a database with more than 1.3 billion user registries that include names and surnames, email accounts, postal addresses, IPs, etc. The company, one of the largest spammers in the world, put this huge amount of data at risk by not properly protecting its backup system. This inexplicable oversight uncovered one of the largest databases in the world.

The security breach suffered by Indian company Zomato in May, caused by external actors, is one of the stand-outs. On this occasion, a hacker with the nickname “nclay” managed to evade security measures and obtained access to the data of 17 million registered users on the platform. The attacker threatened to sell that data on the Dark Web. Fortunately for Zomato, this incident was quickly resolved. The goal of “nclay” was to call attention to the vulnerabilities in enterprise systems and convince Zomato to put up a rewards program to fix security flaws and work closely with the community of ethical hacking.

Tips to avoid falling victim to corporate data theft

No one wants their company to appear in the news as the latest victim of a security breach. To avoid being in that position, the first step is to be aware of the importance of implementing effective security measures and policies. These tips will help you protect your corporate data:

  • Perform vulnerability assessments periodically

    Analyze in detail the status of your security systems on a regular basis. This way you can prevent external attackers from slipping through the cracks and stealing data from your company, as happened with Zomato.

  • Make safe backups

    The case of River City Media demonstrates the danger associated with bad practices in the backup process. Protect your backups as critical elements: include backups in disaster recovery plans, selectively assign right of access to these files, use robust passwords to access backup copies, etc.

  • Encryption is essential

    All sensitive corporate data must be encrypted. That way, even if an attacker gets past the security perimeter, you will ensure that such information is protected. But keep in mind that encryption is useless if you do not protect the keys properly. It is essential to choose a suitable place to protect those decryption keys and have a backup copy of them.

  • Implement advanced cybersecurity solutions

    These platforms, such as Panda Adaptive Defense, monitor all network activity in real time using contextual logic to detect suspicious behavior and implement cyberdefense measures to stop data leaks before they begin.