Unfortunately, data breaches happen pretty much every day, and we don’t see this changing any time soon. While people may not be able to stop their personal data being lost in a breach, there is still plenty that people can do to protect themselves from the potential impact of data breaches.
The NCSC have explained it all in detailed new guidance, but below are some quick tips that we hope you find useful.
You don’t always have to change your password
During a data breach, customer data is stolen (or accessed without authorisation). But this may well not include customer passwords. For this reason, you should only change your password if the organisation tells you that it was part of the breach (NCSC guidance on recovering a hacked account can help you with this).
Why are NCSC saying this? Well, changing your password (and looking after it) takes time and effort. So you shouldn’t do it unless it’s really worthwhile. As mentioned in the guidance, you can find out exactly what information the organisation holds about you (and how you’ve been affected) by contacting the organisation in question, using their official website or social media channels.
For advice on choosing and managing strong passwords, see our other article on this.
You don’t have to avoid sharing data
If an organisation loses your data in a breach, you might wish that you’d never shared it in the first place. But on balance, most people have more to lose by not sharing data when you want to and need to. Often, you’ll have to share data in order to access an organisation’s services. Also, many people have personal data already in the public domain from past breaches, and you can’t put that genie back in the bottle.
You aren’t necessarily at a greater risk of identity theft
You may have expected the NCSC to talk about the risk of identity theft in their guidance, but there’s a reason why they haven’t. Huge quantities of personal data are (sadly) already available online, so individual new data breaches probably don’t put you at much higher risk overall.
Of course, if any particular data breach did carry a heightened identity theft risk, the organisation should include that information when communicating with their customers.
Watch out for the phish!
It’s perhaps worrying to think that your data is ‘out there’ in ways that you can’t control. However, the breach itself (that is, someone accessing your details) isn’t usually the main threat. The more significant threat is someone using the details to make their phishing attacks more realistic, because this make users more likely to click on that dangerous link.
Thanks to NCSC for this info on how to handle a data breach - a great source of cyber security advice from the Government at ncsc.gov.uk. Crown Copyright, content reproduced under license
