Gary Allemann, MD at Master Data Management.

Data breaches have become an increasingly common occurrence in recent years, with companies such as Experian, Masterdeeds and Viewfines suffering some of the largest exposures. These companies are not alone, with over 500 data breaches having been reported to the Information Regulator since October 2022.

These breaches can have serious consequences for consumers, including identity theft, financial fraud, and compromised personal information. It is therefore important for consumers to understand what a data breach is, the types of data that can be compromised, and most importantly, how you can protect yourself.

What is a Data Breach?

South Africa’s Protection of Personal Information Act (PoPIA) defines a data breach as having occurred when there are reasonable grounds to believe that the personal information of a person has been accessed or acquired by any unauthorised person. Cybercriminals typically gain access to this information by exploiting vulnerabilities in a company's security systems or by using social engineering tactics to trick employees into revealing login credentials.

The types of data that can be compromised in a data breach include:

• Personal information (such as your name, address, ID or Passport number, and date of birth)
• Financial information (such as credit card numbers, bank account details, and payment card information)
• Health information (such as medical records and insurance information)
• Business information (such as intellectual property and trade secrets)
• Login credentials (such as usernames and passwords).

How can I Protect Myself from a Data Breach?

While there is no guaranteed way to prevent a data breach from happening, there are steps you can take to protect yourself and your personal information:

1. Use Strong, Unique Passwords: Use strong, unique passwords for each of your online accounts. Consider using a password manager to generate and store strong passwords for you.
2. Enable Two-Factor Authentication: Enable two-factor authentication (2FA) wherever possible, which adds an extra layer of security by requiring a second form of identification in addition to your password.
3. Be Cautious of Suspicious Emails: Be wary of unsolicited emails, especially those that ask for personal or financial information. Phishing emails can look very convincing, but they're often designed to trick you into revealing sensitive information. A simple habit is to check that any hyperlink actually goes to the company that you are expecting it to go to.
4. Keep Your Software Up-to-Date: Keep your software up-to-date, including your operating system, web browser, and antivirus software. Software updates often include security patches that address known vulnerabilities.
5. Monitor Your Accounts: Regularly monitor your financial accounts and credit reports for signs of fraudulent activity. Report any suspicious activity to your financial institution or credit reporting agency immediately.
6. Use Encryption: Whenever possible, use encryption to protect your data. Encryption scrambles your data so that it can only be read by someone who has the encryption key.

What Should I Do if My Data is Compromised in a Breach?

If your personal information has been compromised in a data breach, there are steps you can take to minimise the damage:

1. Find out what information was exposed: If a company contacts you to let you know that your information was found in a data breach, or if you hear about a data breach, you should find out what information was exposed.
2. Change your passwords: If your password was compromised, change it not only on the breached service but also everywhere else you’ve used that password. It's best to start by changing passwords that you know were part of a data breach. Using a password manager can help you store unique, complex passwords for each account.
3. Enable multifactor authentication: If your name and phone number were part of a data breach, attackers can use it to try to log into your account. Enabling Multifactor Authentication (MFA) can help you protect your account. Experts recommend using MFA, but some methods are better than others. It's best to switch to an authentication app such as Google Authenticator or Authy, or you can use a hardware security key such as a Yubikey.
4. Report and remove your personal information: If your home address was compromised in a data breach and you learn that it’s been posted on another site, you can report it and see whether it can be removed. You can also limit how easy it is to use your information by removing it from certain sites online through paid services like Kanary and DeleteMe, or through the time-consuming process of opting out yourself.
5. Place a fraud alert on your credit record: If your ID number or financial information was part of a data breach, you may want to add a Fraud Alert to your credit record. This is a free service available from major credit bureaus that make it more difficult to open a new account. You can also subscribe to a Credit Monitoring service, which will send you a message when someone tries to open an account in your name.
6. Monitor your accounts: Keep an eye on all of your active accounts, including those with your banks, lenders, and retailers.

In conclusion, data breaches can have serious consequences, but by taking steps to protect yourself, you can minimise the risk of identity theft and other forms of financial fraud.