How would your organisation react to a ransomware attack on the personal information you need to run your business? Our recent reprimand for the London Borough of Hackney underlines the importance of having robust security measures in place to protect the personal information of residents. Hackers were able to encrypt 440,000 files. Read about the incident in full: https://lnkd.in/eQD96ruy Ransomware and cyber-attacks use flaws in information security to allow hackers to gain control of information in an attempt to extort money for its return. Over the past few years, we’ve seen the rise in the number and severity of ransomware attacks. In this case, Hackney did do some things well after they found out about the attack: • It let the people impacted know about the attack: • it sent out information and advice to 100,000 homes; • it updated its website informing those affected about the attack; and • it emailed everyone who had consented to receiving marketing information from Hackney. Hackney notified and engaged with the National Crime Agency, the National Cyber Security Centre and the Metropolitan Police to create contingency plans to remove any unlawfully published data. The council created risk assessments to identify people at high risk and had put plans in place in case any more sensitive data exfiltrated by the hacker. And it created emergency business processes in response to the attack. For more information on what your organisation should do in case of a breach, read our guidance: https://lnkd.in/exJWCCsC
Reprimand 🥱
Software Solutions
1moGiven the rise in successful hacks on organisations will the ICO reconsider it's position to advise for PETs that depend on breaches not happening. For instance, secure multi-party computing is a sensible security activity, much like added encryption is, but the underlying data is still there and in both cases vulnerable to breaches revealing the private data, so privacy is not enhanced, only at best better protected (if better protected were simply the goal of PETs, then putting medical files on higher shelves might qualify). For instance, multi-party computation is likely compromised if either party's data is leaked online and the remaining party would then have access to the personal information it was never supposed to be able to join.