Yahoo
2013 0million accounts
Credential theft Lesson: Robust encryption and regular password rotation.
Real security breaches
The largest data breaches in history and the lessons every company should learn.
Real cases
When prevention failed
These are some of the most serious breaches on record. In all of them, the root cause was avoidable.
Marriott
2018 0million guests
Persistent intrusion Lesson: Continuous monitoring: attackers went undetected for 4 years.
0million profiles
Mass scraping Lesson: Limit data exposure and automated extraction.
Equifax
2017 0million people
Unpatched vulnerability Lesson: Update management prevents most breaches.
0million users
Data exposure Lesson: Review API permissions and third parties with data access.
SEPE (España)
2021 Criticalpublic services
Ransomware Lesson: Backups and an incident response plan.
Phone House (España)
2021 0million records
Ransomware Lesson: Network segmentation and encryption of sensitive data.
Common causes
Why do breaches happen?
01
Weak or reused passwords
80% of breaches involve compromised credentials.
02
Unpatched software
Known vulnerabilities that a simple patch would have prevented.
03
Phishing and social engineering
Deceiving the employee is still the favourite way in.
04
Lack of encryption
Sensitive data stored or sent without protection.
05
Misconfigurations
Databases and services exposed to the internet by oversight.
06
No backups
Without backups, ransomware can be definitive.
Our speciality
Handling a data breach is no joke
Suffering an attack is not always avoidable. Handling it badly is. The law requires you to assess the risk, notify the supervisory authority within 72 hours and inform the affected individuals when the risk is high. Improvising during those hours is expensive, and it is penalised separately from the attack itself.
Centros Comerciales Carrefour, S.A.
AEPD resolution · File EXP202305979 · Five breaches notified in 2023
- Art. 5.1.f) GDPR Failure to ensure the security of personal data €2,000,000
- Art. 32 GDPR Insufficient security measures €1,000,000
- Art. 34 GDPR Failure to communicate the breach to the affected individuals €200,000
Total penalty €3,200,000
Two hundred thousand euros of that penalty are not for the cyberattack: they are for not having informed the affected individuals. The AEPD also ordered the company to do so within one month.
Read the full AEPD resolution PDF, in Spanish · Opens in a new tabWhat we do in the first hours
- 01
Containment and logging
We stop the leak and document from minute one what happened, when it was detected and which data is affected.
- 02
Risk assessment
We assess the impact on the rights and freedoms of the affected individuals, which is what determines the obligations triggered.
- 03
Notification to the authority
Where applicable, we notify the AEPD within the 72-hour deadline, with the content and detail required by Article 33.
- 04
Communication to those affected
When the risk is high, we draft and coordinate the communication to data subjects under the terms of Article 34.
- 05
Record and corrective measures
Every breach is entered in the internal register, together with the measures taken. That register is the first evidence the Agency will ask you for.
Already in the middle of an incident? Call us on +34 620 646 069.
How we protect you
A breach costs far more than preventing it
The average cost of a major breach exceeds four million euros, not counting reputational damage. A timely audit costs a tiny fraction.
- Risk and vulnerability analysis
- Technical measures: encryption, backups and access control
- Response and notification protocol within 72 hours
- Ongoing training against phishing and social engineering
Don’t wait to suffer a breach
Assess your company’s security level today with a free first evaluation.