Data breaches continue to make headlines, with corporate incidents grabbing the most attention. A prime example is the Equifax breach, where a server exploit compromised credit reports of over 140 million individuals. The breach took months to discover and resolve, ultimately resulting in Equifax settling with the FTC for a $575 million fine.

Not so long ago the Electoral Commission revealed it fell victim to a “complex cyber-attack,” potentially impacting millions of voters. Unspecified “hostile actors” accessed electoral registers from August 2021 and infiltrated emails and control systems. Alarmingly, this attack went undetected until the following October, leaving sensitive data exposed to cyber criminals for over a year. It’s astonishing that adequate protections were not in place to ensure timely detection and management of the breach.

According to the UK’s NCSC, half of businesses and about a third of charities have reported experiencing some form of cyber security breach or attack. This figure rises to approximately 70% for medium-sized businesses and 74% for large enterprises. Phishing remains a favoured attack method due to its relative simplicity, with AI now generating new variations of old scams.

Most data breaches occur unintentionally, often due to employees making mistakes because they lack awareness of proper procedures. Who bears responsibility? Is it the employee or the employer for not providing sufficient cyber awareness training? That’s open to interpretation.

Here are some notable examples from the Information Commissioner’s Office (ICO):

• A data controller inadvertently sent paperwork to a child’s birth parents without redacting the adoptive parents’ names and addresses. Upon discovering the breach, the data controller failed to inform the adoptive parents.

• A debt insolvency agent mistakenly emailed a vulnerable new client’s file to a colleague in another department. The colleague quickly deleted the email and alerted the sender about the mistake.

• An employee misplaced his briefcase containing work on an unencrypted laptop and unredacted paper files related to a sensitive court case, which included information on criminal convictions and health details. Initially, he believed both the laptop was encrypted and that the paper files were redacted. After informing his manager, who reported it to IT, the laptop was remotely wiped without initially notifying the ICO. The data controller later reported it after realising the laptop was unencrypted.

• A courier mistakenly delivered medication intended for one patient (Patient A) to another (Patient B). After Patient A complained, the pharmacist recognised the error and arranged for the unopened medication to be picked up and delivered correctly.

• A law firm employee fell victim to a phishing attack after clicking on a link in an email that led them to enter login credentials on what they thought was a legitimate site. The IT department later discovered that their email account had been compromised, leading to significant unauthorised payments being made by clients due to spoofed communications.

These cases are just a small sampling.

Now let’s discuss ransomware. There’s a common misconception among SME management that ransomware primarily targets larger companies since SMEs seem too small to be lucrative targets for cybercriminals. However, when SMEs do get attacked, ransom demands can be surprisingly low—often between £500 and £1,000—leading many SMEs to pay up without hesitation. This poses significant risks because often their data has already been stolen, and sometimes criminals fail to restore access afterward, leaving SMEs financially strained and unable to operate.

Preventing such attacks in the first place is far more advantageous. Here are several strategies you might consider implementing:

• One of the most impactful steps an SME can take is providing Cyber Awareness Training for employees. Research shows that 90% of data breaches stem from human error; it’s unlikely an employee will intentionally harm your business. However, without proper training, they may unknowingly engage in risky behaviour. Cyber security awareness training is crucial; staff need knowledge about potential threats. Cyber security is not just an IT issue; it’s a business-wide responsibility that requires everyone’s involvement. Effective strategies tend to follow the KISS principle—Keep It Simple Stupid.

• Another cost-effective measure is developing robust policies and procedures related to cyber security that are communicated throughout your organisation and regularly updated to remain relevant. Providing employees with clear guidelines on how to respond if they suspect suspicious activity supports them rather than penalising them for mistakes. Many SMEs lack adequate policies or settle for generic templates found online that seldom meet their needs.

• Review your backup strategy as well. Even if using cloud-based services, your data may not be adequately secured, despite providers’ claims. A better approach would be implementing a backup strategy where your data is backed up nightly onto magnetic media storage that’s stored securely offline. In case of an attack that locks your data, you could wipe affected workstations and restore information from backups without significant downtime.

• EMail remains one of the most common attack vectors. Numerous products claim to block malicious emails effectively; many excel at this task. For SMEs, cost is often a deciding factor when selecting these products. Unfortunately, some still opt for low-cost or free anti-malware solutions. Understanding that quality correlates with price is essential; if it’s free, you’re likely facing issues down the line.

Turning to how your systems might be monitored for security issues, we have been exploring options in the market for an affordable security managed service tailored specifically for SMEs and we believe we have found it! Our solution emphasises simplicity while utilising enterprise-grade technology to streamline daily operations effectively. Our unified platform seamlessly detects, prevents, and responds holistically to cyber threats without hassle or excessive costs.

We are offering a free trial that includes:

a. Email security.

b. Cloud data protection.

c. Automated cyber awareness training.

d. External risk assessment.

e. Endpoint security.

f. Secure browsing practices.

g. Phishing simulations.

h. Plus, as an added bonus: cyber insurance priced based on your risk score within our system—the lower your risk score, the more affordable your insurance!

This service is specifically designed for businesses with 1-250 IT users; while most SMEs typically fall between 10-15 users, we’re flexible! It’s a managed service approach with proactive risk mitigation tailored according to your preferences—all at just £12 per user per month!

We’re also introducing an intuitive cloud software solution focused on data protection that empowers organisations by securing their information while giving IT professionals an easy way to track sensitive data and manage risks effectively. The system routinely audits company data to locate sensitive information and applies necessary updates and encryption automatically.

This method ensures organisations always know what sensitive data they possess while keeping it secure through automatic encryption measures, making data security straightforward so businesses can protect private information as circumstances evolve over time, without needing complex software requiring specialised expertise.

Here are 2 very short videos explaining our solutions.

Why Your Business Needs Protective Monitoring – https://bit.ly/3Qy4u0x

Mastering GDPR Compliance: Safeguarding Your Company – https://bit.ly/4berDPa