Introducing the vicious cycle of data breach fatigue

It seems like we can never escape them; they’re in the headlines and our news feeds all the time, and data breaches are such a common occurrence these days.

So, what is being done to stop data breaches occurring?

Surely with advances in smartphones, self-driving cars and artificial intelligence, we have the technology and skills to stop hackers from cracking websites and security walls? Surely we have access to enough decent cybersecurity software to protect data, and are capable of training staff and enacting procedures and protocols to protect data from leaks?

In a world where many prioritise fast profits over data protection, there may simply not be enough respect for cybersecurity. Many organisations continue to fail to recognise the value of personal data and the impact it has when it’s stolen or lost. In a bid to create incredibly in-depth profiles on customers, businesses, are trying to obtain as much information as they can so they can market their goods and services to target audiences, the importance of data protection can easily be lost.

That information isn’t just a tool; enough data can amount to a person’s life!

‘Breach fatigue’

Trend Micro’s Vice President, Rik Ferguson, coined the term ‘breach fatigue’ to suggest being sick and tired of hearing about data breaches, and a symptom of it is people becoming desensitised to data breaches.

In light of the Equifax data breach, how many of us were panicked?

With so many data breaches going on, are we still taking them seriously, or just accepting them as a part of life in the digital age? Through ‘breach fatigue’ or otherwise, we may be stuck in a vicious cycle: an indifference to data breaches where we don’t value our data, and this could lead organisations to also not value our data and fail to take steps to properly protect it. Without proper protection, a data breach is likely to happen – a data breach that people may be indifferent to.

How can we make organisations take data protection more seriously?

A cycle like this needs to be broken. Laws and sanctions can of course help tackle an organisational view when it comes to our data: something that needs to be protected at the cost of fines and penalties where failure occurs.

The real power, however, may be the customer.

An organisation could overcome a fine, but without customers, they can’t exist. If customers valued their data and prioritised it, businesses must too; if customers stopped using organisations who are guilty of preventable breaches, maybe then they may sit up and take notice.

Our view of what victims should do

If you are concerned about a data breach, voice it. If you are a victim of a data breach, take action.

As a consumer whose data has been misappropriated, you may be entitled to take legal action and receive compensation. By taking such action, not only are you making a rightful claim for compensation for the damage caused to you, but you are holding the company accountable for their negligence.

Making businesses recognise their accountability and responsibilities can help them to step-up to their data protection procedures.

What should organisations do?

They need to understand. Awareness of data breaches is incredibly important for people to understand what risks there are and the impact they can cause.

They also need to have preventive measures in place. It’s not enough to just be aware of data breaches and looking out for them until they come. Pre-emptive measures like setting up security walls and alarms can be incredibly important barriers for preventing third-party attackers as well as internal mistakes.

If you knew a burglar has been terrorising your town, you would probably take pre-emptive security measures like locking your door and installing an alarm system; so, why would you not do the same in a world ravaged by data breaches?

Damage control – and effective damage control at that – is also incredibly important. A damage mitigation plan should be in place, and organisations ought to be honest and open to disclose a breach to authorities and consumers to work together to limit damage caused.

A comparison between the EU and U.S. data breach notification laws

A simple guide to data breach terms