One of your vendors will suffer a data breach. It is a when, not an if. They may have already, but not yet know it. Because marketing handles so much customer data, it’s essential to know what to do when a breach happens.
There will be a breach
in 2023, 61% of companies reported a third-party breach, according to a study by Prevalent, a third-party risk management provider. That’s an increase of nearly 50% in the previous 12 months and three times as many as in 2021.
Furthermore, these breaches are expensive and slow to be discovered. The average cost of a data breach this year is $4.88 million, the highest average on record, according to the 2024 IBM/Ponemon Cost of a Data Breach Report. The average time from a breach happening to its being discovered is 194 days, the report found. Also, the average time from discovery to the breach being contained is 292 days.
Here are just a few of the major breaches so far this year:
- Russia used an attack on Microsoft’s email systems to steal data and personal information from the US government.
- Personal information for approximately 6.5 million Bank of America customers was stolen through the systems of Infosys McCamish.
- Nearly a terabyte of data was stolen from Disney via Slack.
“One security problem with SaaS is implicit trust,” said Paul Shread, international editor for The Cyber News from threat intelligence vendor Cyble. “You’ve invited the vendor deep into your environment.”
What to do before it happens
Any enterprise of significant size already has an IT security unit with policies and procedures for vetting vendors. These involve checking vendors’ security practices, understanding how they handle their data and ensuring they follow your security standards and data handling requirements.
Dig deeper: AI and security are the focus of latest Salesforce acquisitions
If you are a smaller business, that IT security “unit” should be one person in particular in your IT department. If that is beyond the scope of expertise of your staff, then you probably should be outsourcing your IT function.
“When you’re doing the onboarding of a vendor, look at certain standardization of compliance regulations and setting that up in the right way,” said James Alliband, head of marketing for Risk Ledger, a supply-chain risk-management solution provider. “Ask them what best practice is to ensure the software is running in a secure, compliant fashion.”
Other steps include:
- Using multi-factor authentication.
- Keeping an accurate inventory of vendors.
- Determining if you need cyber insurance to cover the cost of financial damages.
- Only collect data you absolutely need, and do not keep it longer than necessary.
- Limiting the number of staff with access to those who absolutely need it.
- Encrypting data.
“The best you can do is to maintain good security practices to limit damage: role-based access control, device control, logging, monitoring, MFA, segmentation, encryption, configuration,” said Shread.
Finally, if you don’t already have an incident response plan, get one. The Federal Trade Commission has several useful resources for this.
The first thing to do
In most cases, the vendor will notify you by email. You must act as soon as it arrives.
“Inform your security team or the important person managing the software,” said Alliband. “Let them know what’s happened, what the email is, forward the email to them.”
The longer you wait, the bigger the problem will get. To that end, be sure you have the contact information available at all times.
Alliband said do not assume the security team knows what data is in that piece of software or what it connects to. So, the second thing is to get that information (if you don’t already have it) and pass it along.
“Let them know what the solution is, what data is in there, if there are certain things that are confidential in there,” he said. “Give them a full scope of what that is and rapidly educate them about that and who has access to the data internally as well.”
Establish clear lines of communication with the vendor
One person needs to be in charge of communicating with the vendor, otherwise, confusion will reign. That person may be from Infosec, but they may want it to be someone from your team who knows the solution well.
The first thing to do is confirm the vendor is protecting data. How to do this should be in your incident response plan. Follow up with them regularly about this.
Review the contract
There are times in business when a lawyer is called for. This is absolutely one of them. Go over the contract with a legal expert. They can guide you through the legal parts, and you can help them with the technical parts. The contract should have a data breach notification requirement and possibly what remediation is required of the vendor.
Data breaches put a lot of stress on the vendor-client relationship. It’s essential that you can ensure the vendor is meeting their obligations.
Set clear expectations for next steps
When a data breach occurs, it’s crucial to establish a clear path forward. Here are things to consider.
Deep audit testing
This is essential for:
- Identifying the root cause of the breach.
- Assessing the full extent of the damage.
- Developing strategies to prevent future incidents.
Vendor cooperation
Your vendor’s willingness to work with you will determine where the relationship goes. Their cooperation should include:
- Providing full access to relevant systems and data.
- Allocating necessary resources for the audit.
- Sharing all pertinent information transparently.
Being reluctant or resistant to these is a huge red flag. On the other hand, a commitment to cooperation and transparency means you have a good partnership.
Dig deeper: U.S. state data privacy laws: What you need to know
Notify customers
The worst-case scenario is your customers find out about this breach from the press before they hear about it from you. In the end, all companies sell the same product: trust. Your customers must be informed as soon as possible, with as much information as possible. Do not wait until you have all the information about remediation. Tell them what you know and what steps you are planning to take. When you have substantial information, pass it along.
Stay in touch even if there are no developments, so they know you haven’t forgotten them.
After the breach
Even though the breach occurred externally, there are several things to do internally to deal with it.
- Determine the size of the breach: You need to know how many customers were affected and how many of your systems were compromised.
- Notify the correct government entities: Depending on your industry and location, you may need to contact law enforcement, regulators or the State Attorney General.
- Find the root cause: The breach has identified a weakness in your system. Find it and fix it.
- Review security processes: Solitaire teaches us that it is possible to do everything right and still lose. Take the time to review processes and find out if you did everything right.
- Document the incident: For legal reasons and internal review, it’s important to document as much as possible. Do this in real time, including electronic and verbal communication with the vendors, customers and government institutions. This will help in the security review process.
“The really important thing is absolutely protecting customer relationships, but don’t cause unnecessary panic either because that can be really time-consuming for customers,” said Alliband. “So many data breaches happen that the customers never hear about because they haven’t actually been affected by the breach itself.”
The post What to do when your vendor has a data breach appeared first on MarTech.
# Steps to Take When Your Vendor Experiences a Data Breach
In today’s interconnected business environment, companies often rely on third-party vendors for various services, including cloud storage, payment processing, and IT support. While these partnerships can enhance efficiency, they also introduce new risks, particularly when it comes to data security. A data breach at one of your vendors can have serious consequences for your business, including financial loss, reputational damage, and legal liabilities. Knowing how to respond quickly and effectively is crucial to minimizing the impact.
Here are the key steps to take when your vendor experiences a data breach:
## 1. **Confirm the Breach and Gather Information**
The first step is to confirm that a breach has indeed occurred and gather as much information as possible. Vendors are typically required by law or contract to notify affected parties when a data breach occurs. However, the quality and timeliness of the notification can vary.
### Key Questions to Ask:
– **What type of data was compromised?** (e.g., personal information, financial data, intellectual property)
– **How many records were affected?**
– **When did the breach occur?**
– **What was the cause of the breach?** (e.g., hacking, insider threat, system vulnerability)
– **What steps is the vendor taking to contain the breach?**
Having this information will help you assess the severity of the situation and determine the appropriate course of action.
## 2. **Assess the Impact on Your Business**
Once you have a clear understanding of the breach, assess how it affects your business. The impact will depend on the type of data the vendor handles for you and the nature of your relationship with them.
### Consider the Following:
– **Data Sensitivity:** If the vendor handles sensitive customer data (e.g., credit card information or personal identification numbers), the breach could expose your customers to identity theft or financial fraud.
– **Regulatory Compliance:** Depending on your industry, you may be subject to specific data protection regulations such as the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), or the Health Insurance Portability and Accountability Act (HIPAA). A vendor breach could put you at risk of non-compliance.
– **Operational Disruption:** If the vendor provides critical services, the breach could disrupt your operations, leading to downtime or loss of revenue.
## 3. **Notify Key Stakeholders**
Once you’ve assessed the impact, it’s essential to notify key stakeholders within your organization. This includes senior management, your legal team, and your IT department. Depending on the severity of the breach, you may also need to inform your customers, partners, and regulatory authorities.
### Internal Stakeholders:
– **Legal Team:** They will help you navigate any contractual obligations, regulatory requirements, and potential liabilities.
– **IT and Security Teams:** These teams will need to assess whether your systems have been compromised as a result of the breach and take steps to secure your infrastructure.
– **Public Relations/Communications Team:** If the breach is likely to become public, your PR team will need to prepare a communication plan to manage the potential reputational fallout.
### External Stakeholders:
– **Customers:** If customer data has been compromised, you may be legally required to notify them. Be transparent about the situation and provide guidance on steps they can take to protect themselves, such as monitoring their accounts or changing passwords.
– **Regulatory Authorities:** Depending on the jurisdiction and the nature of the data, you may be required to report the breach to regulatory bodies within a certain timeframe.
## 4. **Review Your Vendor Contracts**
Your contract with the vendor should outline their responsibilities in the event of a data breach, including notification timelines, liability, and remediation efforts. Review the contract to ensure that the vendor is fulfilling their obligations and to determine whether you have any legal recourse.
### Key Contractual Elements to Review:
– **Data Breach Notification Clauses:** Ensure the vendor has notified you within the agreed-upon timeframe.
– **Indemnification Clauses:** Determine whether the vendor is liable for any damages or costs associated with the breach.
– **Service Level Agreements (SLAs):** If the breach has caused a disruption in service, review the SLA to see if the vendor is in breach of contract.
## 5. **Work with the Vendor to Contain the Breach**
Collaborate with the vendor to ensure that the breach is contained and that no further data is compromised. This may involve:
– **Shutting down affected systems or services.**
– **Implementing security patches or updates.**
– **Conducting a forensic investigation to determine the root cause of the breach.**
Your IT and security teams should work closely with the vendor to ensure that all necessary steps are being taken to secure the compromised data and prevent future breaches.
## 6. **Conduct a Risk Assessment**
After the immediate threat has been contained, conduct a thorough risk assessment
Recent Comments