Data Breach

A breach can happen when attackers take personal information from a corporate server, when an insider steals customer information, or when information is accidentally exposed on a company's website. NIST's broader definition covers sensitive information whether it is physical or electronic.

Large corporate data breaches can affect millions of customers and expose personal information that is then used in follow-on crimes. Thieves with stolen names and Social Security numbers can open new accounts in the victim's name or commit tax identity theft, and people affected by a breach may receive phishing scams tied to it. Stolen credentials leave a system vulnerable until they are changed, even after the attacker's tools have been removed.

The FTC's guide for businesses starts with securing operations. A response team may include forensics, legal, information security, IT, operations, human resources, communications, investor relations, and management. Affected equipment goes offline at once, but machines stay powered on until forensic experts arrive, and authorized users get new credentials. The organization then fixes vulnerabilities, reviews what service providers can access, checks whether network segmentation contained the breach, and prepares a communications plan that neither misleads nor withholds details people need to protect themselves.

All US states, the District of Columbia, Puerto Rico, and the Virgin Islands have laws requiring notification of security breaches involving personal information. The FTC advises notifying law enforcement, affected businesses, and affected individuals, and considering at least a year of free credit monitoring or other support when financial information or Social Security numbers were exposed.