Data breaches have become a common occurrence, causing immense financial and reputational damage to businesses across the globe. Already in 2023, several high-profile data breaches have captured the attention of cybersecurity professionals and the public alike. As these breaches highlight the vulnerabilities that cybercriminals exploit, they serve as a learning opportunity, allowing organizations to understand and implement effective preventative measures.
This article will examine three recent data breaches from 2023 and discuss how common cybersecurity protocols, if properly implemented, might have prevented them.
#1: Chick-fil-A
Fast-food chain Chick-fil-A suffered a significant cyber attack in March this year, that compromised customer information. The company stated that 2% of its total customer data had been exposed, without stating the exact number of records, which is a common practice.
Although the full extent of the breach is not known, it is evident that data including names, email addresses, and payment information, might have been exposed during the attack. As a result, those customers are now at increased risk of identity theft.
What Might Have Helped?
One common cybersecurity protocol that could have prevented a breach like this is the implementation of Transport Layer Security (TLS). TLS is a protocol that provides encryption and authentication for data transmitted over a network, helping to secure communication between the company’s systems and customer devices.
TLS is a common requirement in compliance frameworks like the PCI DSS, and its incorrect application would have been picked up in a common vulnerability scan.
By implementing TLS and regularly updating it to the latest version, companies like Chick-fil-A can better protect sensitive customer data from being intercepted or accessed by unauthorized parties during transmission.
#2: Activision
Activision, a major gaming company, experienced a data breach in which hackers stole usernames, passwords, and personal information. The breach affected a large number of users across various platforms, creating a potential risk for credential stuffing attacks and identity theft.
What Might Have Helped?
A crucial cybersecurity practice that could have helped mitigate this breach is the use of multi-factor authentication (MFA). MFA requires users to provide at least two forms of verification, e.g., a password and a unique code sent to their mobile device, before granting access to their account.
By implementing MFA, Activision could have made it more challenging for attackers to gain unauthorized access to user accounts, even if they had obtained compromised credentials from the breach.
#3: Mailchimp
Email marketing service Mailchimp experienced a data breach where an unauthorized party accessed the user data stored in its system. This breach exposed sensitive information, including customer names, email addresses, and hashed passwords, potentially putting users at risk of phishing attacks and other malicious activities.
What Might Have Helped?
One cybersecurity protocol that might have prevented a breach like Mailchimp’s is the adoption of a zero-trust security architecture. While not a small investment for a company, this model operates on the principle of “never trust, always verify” and requires strict identity and access management controls for all users, to limit access to sensitive data.
Had Mailchimp implemented a zero-trust security model, the unauthorized party might have been denied access to user data, even if they had infiltrated the company’s network, thus preventing the exposure of the breached information.
The Takeaway
Contrary to a common belief, the success of cyber attackers is often not a result of their increasing sophistication. More often, malicious actors find holes that were open due to the non-implementation of a common security measure.
The unexciting story of preventing data breaches is that firms are safer when well-known cybersecurity policies are well-implemented and well-enforced.
