Silence is Golden for Breach Prevention, Not Reporting

•
May 8, 2025    

Two decades after California introduced the world to data breach notifications, organizations have collectively battened down their cybersecurity hatches and fixed the problem once and for all.

See Also: OnDemand | Resilience in Crisis: Recovering Your Minimum Viable Company Fast

Welcome to our bright, new post-breach age, where everyone’s information remains safe from prying eyes not just in the Golden State but far beyond, and organizations never have to notify individuals that they’ve exposed their personal information.

I’m joking, of course. More breaches than ever arrive fast and furious, lately brought to you in no small measure by Russian-speaking ransomware groups and their affiliates, among a host of other cybercriminal and occasionally nation-state nastiness.

That’s despite all 50 states in the U.S. now having data-breach notification laws on the books. One of their shortfalls is that breached organizations mostly don’t have to tell anyone – authorities, regulators, individuals – how attackers broke in or exactly what they stole. Many U.S. organizations are parsimonious with that information, despite its use in helping everyone better track and combat emerging threats.

Thanks, then, to the General Data Protection Regulation – European privacy law still on the books in the United Kingdom – for giving us details pertaining to the root causes of so many data breaches.

From January through March, about one in eight cases in Great Britain involved unauthorized access to data or employees emailing people’s personal data to the wrong recipient. Overall, 11% of breaches traced to a phishing attack, while ransomware accounted for 10% of breaches.

That’s from the Britain’s Information Commissioner’s Office in a release of statistics covering the first quarter of this year. The ICO received 8,188 breach notifications, down slightly from the 8,367 in the prior quarter.

“Data security incidents occur when organizations do not have ‘appropriate technical or organizational measures’ to protect the personal data they hold,” the ICO said, quoting the text of the GDPR, which the watchdog enforces in Britain.

Unlike many EU member states’ data protection agencies that domestically enforce GDPR, the ICO releases anonymized data pertaining to breach reports. The regulator doesn’t mention the organization involved, unless it investigates a breach and finds shortcomings that lead to it making a public censure or issuing a fine.

Under GDPR, the regulator has the power to fine organizations up to 17.5 million pounds – $23 million – or up to 4% of their annual global revenue, whichever is greater. The agency last year clarified that U.K. organizations that work closely and transparently with regulators and cybersecurity officials will be treated with greater leniency, if their conduct merits penalties and a fine.

Organizations aren’t always forthcoming. Of all reported incidents, 10% trace to each of these catch-all buckets: “other” cyber or non-cyber incident. Sometimes, this is code for we don’t know, because we weren’t bothering to maintain and monitor our logs, despite copious advice from cybersecurity agencies and experts that we do so. Other times, maybe attackers were just really good at covering their tracks.

Even so, many breaches continue to result from what should arguably be easy-to-prevent behavior. In the first quarter, nearly 6% of breaches stemmed from a failure to redact information, while 2% resulted from failing to send an email using BCC, or what cool kids in the typewriter days called “blind carbon copy.”

Likewise, it would be great to say “gone are the days when breaches traced to sensitive documents left at a bus stop.” That featured in a notable English breach just four years ago with consequences for the government official involved. Basically: good on you for using public transport; we’ll get back to you on filling that open British ambassadorship to NATO.

In fact, such paperwork misplacement problems continue. In the first quarter, “loss/theft of paperwork or data left in insecure location” featured in 452 of incidents – comprising nearly 6% of the total – while “incorrect disposal of paperwork” accounted for 34 incidents. Even worse was “verbal disclosure of personal data,” which accounted for 675 incidents.

As that highlights, breaches of personal data keep happening for reasons that don’t always involve malware-armed hackers. Sometimes, yes, an initial access broker compromises an organization and hands off victim access to a ransomware-addicted bestie. Other times, an employee doesn’t keep their mouth shut on a train.

Armed with such information, organizations have a call to action for how to hone their defensive plans, as well as organize their security awareness training, to better ensure they don’t become the next such victim.

Or in the words of the ICO: “We publish this information to help organizations understand what to look out for and help them to take appropriate action.”