In a day and age ruled by modern technology, cybersecurity issues have become one of the most significant problems a company or organization can face. In fact, the Allianz Risk Barometer 2023 says cyber incidents are the number one business risk for companies around the world, with data breaches the cyber exposure the top concern. So, what does that mean for you?
If you aren’t already prepared for a cyber breach, you are a step behind.
A Look at Some of the Biggest Breaches
Ascension Healthcare Ransomware Shutdown
Remember the attack that shutdown Ascension healthcare earlier this year? Unusual activity was first detected on May 8, forcing the company to shut down its’ impacted systems, reach out to the authorities and work with cybersecurity professionals. The attack caused major disruptions including inoperative phone systems, clinic disruptions, diverting ambulance services, canceling treatments, and making electronic health records unavailable to most patients.
The attack not only exposed technical issues with Ascension’s systems, but it also exposed a lack of preparedness. Team members failed to respond to system restoration quickly and accurately, which may have been a direct result from three years earlier when Ascension fired hundreds of local IT staff members in a cost-cutting maneuver to outsource to India. Though outsourcing, itself, doesn’t cause problems, lack of leadership and clear direction does.
Anthem Healthcare Breach of 2015
Considered one of the largest healthcare breaches to date, the breach of Anthem resulted in eighty million people being impacted. This includes social security addresses, medical ID numbers, and other personal information. However, the Anthem team immediately got to work setting up a dedicated microsite, anthemfacts.com, as well as a hotline that current and former customers could call to obtain information. Anthem’s FAQ page also had additional details. I would add in something about how this was 9 years ago and that though systems are far more upgraded, so are the hackers.
January 2021 Microsoft Breach
More than 60,000 companies worldwide were impacted when hackers hit the Microsoft Exchange email servers. Hackers took advantage of the company’s vulnerability for three months to deploy malware, gain backdoor server access to other systems, take down servers completely, and request data access. While Microsoft created a data patch to fix these cybersecurity errors, it required individual servers to update their systems. Without the update, hackers still had access. Microsoft needed to launch a campaign informing its stakeholders what they needed to do immediately.
After the Breach: Lessons to Be Learned
These are only a few of the major data breaches we’ve seen over the past few years. Though not considered a hack, within the past couple of weeks we recently saw how one minor fault in a software update could take down millions of companies and airlines (see CrowdStrike). That’s why it’s important for your company to be prepared for a when a crisis happens, not if. Here are a few takeaways:
- Timing: Don’t wait several weeks to tell people what’s going on. They need to know now! When dealing with a situation in which data has been breached, your customers should know within a matter of days.
- Information Dissemination: When your information is hacked, the first thing you want to know is how you were impacted. If your company was hacked, consider offering resources to your customers to provide clear information on the breach. Provide excellent customer service, such as phone numbers for people with questions to call and share what comes next to improve your company and how you’re helping your impacted customers.
- Create Careful Messaging: It is important to create powerful messaging to your stakeholders and those impacted by the crisis. However, it is imperative your message is a) carefully thought out and b) matches your messaging across all channels.
- Compensation: After a breach, many companies may look to try to offer some form of compensation to those impacted by the breach to instill a sense of loyalty and trust. If your company does, this, it’s critical to follow through. However, be careful in your choice of compensation. We have all seen the blowback CrowdStrike recently got for giving everyone $10 Uber Eats gift cards… Don’t be cheap.
If your company needs help with creating a crisis communications plan, reach out to us at [email protected]. We’ll help you get on the right track!
