How to understand the true implications of a data breach for your organisation

Visualise your notification campaign

The first step is to consider how many customers you might need to inform following a data breach, and how you will contact them. The preference for many businesses is to contact customers by email, in which case you need to ensure you have email addresses for every customer. If you don’t, you will need a postal address or phone number. Think about how long it will take to contact all of your customers. Your desire may be to contact everyone within 24 hours of a breach, but if you have a million customers that simply will not be possible. Three to five days is more realistic. If you know this in advance, you can set expectations and prepare appropriately.

Prepare your messages

Next you need to think about what you will tell customers. To some extent, this will need to be adapted following a breach, to reflect the specific nature of the incident. However, many key messages can be agreed in advance, and these will need to be signed off within your organisation – particularly by legal teams.

What entity or brand will you use? Do you have multiple brands across international borders, for example. Do you need different messages for different cohort groups, such as employees, customers, pension holders and others? If you can pre-approve messages and templates for all groups in advance, it will save so much time following a data breach.

Get your resources ready

Having determined how you will contact customers and what you will say, you need to think about the resources required to deliver this communication campaign. Do you have the skills and resources to handle this in-house, or will you need external support? Do you need to train people in advance, so they are ready to respond quickly in the event of a crisis?

What about the resources you will need to handle queries from affected customers? If you are informing thousands of people about a data breach, how will you handle potentially hundreds of incoming calls? What will you say to people? If your customer base is international, do you need agents who can answer queries in different languages? Ideally, you need to have scripts prepared in advance to ensure you give consistent messages to those affected. Failing to respond to incoming queries could be hugely damaging to your organisation. Having informed customers that their data has been compromised, you will compound people’s anxiety and uncertainty if you are unable to answer their queries promptly.

What is your attitude to risk?

Having understood the implications and the response requirements, you then need to think about your risk appetite. How much do you want to invest in preparing in advance, and how much are you willing to leave to chance? If you need external call centre resources to manage your response, are you happy for these to be provided on a ‘best endeavours’ basis? That means your crisis response provider will do everything possible to provide the resources you need, but without providing any guarantees.

Response resources are finite, and if there is another breach on the scale of the MOVEit exploitation, those resources could be in short supply. An alternative is to pay a retainer for a “reserved response” service, which guarantees that the resources you need will be available in the event of a data breach.

Implications for your whole organisation

There are lots of balances to strike in planning and preparing for a crisis response. One thing that quickly becomes clear is that this is a business issue, not just an IT issue. The impact of a data breach affects the entire organisation and all its customers or service users. Clearly, suffering a cyber-attack is extremely disruptive to business operations, requiring significant work to get IT systems back up and running. But in addition, managing your customer response and helping to minimise financial and reputational damage is just as complex and fraught with challenges. There’s a lot at stake, so it’s important to get it right.

Throughout our consultancy work, we aim to serve up a dose of reality and enlightenment. We help organisations to assess what they will need to do in practice, how long it will realistically take and what they can do to prepare for an efficient and professional response. The outcome is a well-considered “consumer response plan” that can be signed off by the board and which enables everyone in the business to understand their role in the event of a data breach. How to ensure this plan is resilient and can be enacted in practice will be the subject of my next blog.