What is the Most Vulnerable Data My Company Holds?

Data security is on every priority list in 2022. With the frequency of breaches never higher, many businesses assess their situation and ask cybersecurity questions.

With cybersecurity policy, everything boils down to risk. Ultimately, every decision-maker wants to know, “how likely are we to be attacked?”

Many believe cybercriminals only target certain kinds of data. Sensitive information, high-value financial data, and medical records are all widely accepted to carry a high risk.

The misconception? That storing none of the above means little-to-no risk. Almost every document stored on your company servers is a potential target for cybercriminals in today’s threat landscape. 

We will break down the data types that carry the highest risk, so you’ll finally know how much potential threat is stored in your servers.

The scale of data theft

Data and information theft have always accounted for a large portion of cybercrime. Some estimates have the frequency at 44 records stolen per second. That’s 3,809,448 per day globally. Less conservative figures put the number as high as 22.5 million.

Whether the actual figure is closer to three or twenty-two million is irrelevant. Both ends of the scale are high. What matters is that every day your data and records are at risk of being stolen.

Why do cybercriminals want my company data and records?

The reason data theft remains a favorite pastime of cybercriminals is primarily financial. While this is obvious for certain kinds of data (such as customer payment information), the financial incentive for theft isn’t as straightforward as others.

Hackers and cybercriminals can turn almost any stolen data into a profit. Even seemingly meaningless information is valuable to somebody, somewhere, making it worth stealing. Sometimes stolen data is sold on the dark web, and for others, it is used for ransom attacks. The list of ways cybercriminals can capitalize on stolen data is almost as long as one of the ways they can steal it.

Remember, not all hackers are after huge sums. Many small businesses are severely disrupted by cybercriminals seeking to walk away with as little as a few hundred dollars (and some by thrill-hackers who aren’t financially motivated).

As a rule of thumb, never assume your data and records are safe because they don’t seem financially valuable. No matter how much you believe your data to be “worth” to a hacker, it is still at risk, and the costs of a breach to your business are always high.

The types of data most vulnerable to attempted theft

Now that we’ve covered the scale of data theft let’s break down the highest-risk types of data and records that businesses like yours may have on their servers.

Payment data.

71% of all data breaches are financially motivated. It’s unsurprising then that payment data is the type of record most targeted by hackers.

This is why many small businesses’ belief about their size makes them unappealing to cybercriminals is so dangerous.

Stolen customer credit cards, visa debits, PayPal, or other payment credentials are a source of easy income for hackers. There are many high-profile incidents where gigabytes of customer payment information were stolen from companies and sold on the black market.

One of the most notorious examples is the Adobe breach of 2013. Hackers stole nearly 3 million credit card numbers from a compromised database of 38 million Adobe users. The costs to Adobe were known to reach at least $1.1million, but the exact total when the (undisclosed) settlements with former users are factored in is still unknown.

It’s clear why 3 million credit card numbers are an enticing prospect for a cybercriminal. While there are few companies with as many users as Adobe, the high-profile breach they experienced was far from an isolated incident.

Why the Adobe breach wasn’t an isolated incident

Selling stolen data on the black market is risky and isn’t the goal for most hackers. Most stolen payment information is used to skim small amounts, directly purchase goods, or open new credit lines to be drained into separate accounts controlled by cybercriminals.

This makes small businesses incredibly vulnerable. If your aim isn’t to sell millions of payment details, there’s little incentive to hack a corporation like Adobe with a dedicated cybersecurity team.

Most cybercriminals are likely to target less-protected payment records held by SMEs. Not only are these easier to obtain, but they’re also far less likely to attract attention (meaning the operation can continue another day).

It’s highly unlikely you will have no customer payment info on your servers in 2022. Whether dealing with three or three million users, you must keep their payment data secure.

Authentication Details

Authentication details are perhaps the most dangerous records to lose in a breach. All it takes is one compromised login for cybercriminals to browse your systems at their leisure. Once they have access, it’s only a matter of time before further data (like customer financial records) is seized.

Credential-based attacks aren’t rare. 81% of breaches in 2020 utilized stolen and/or weak passwords. Authentication details and credentials are obtained in many ways. Keylogging software is one, but targeting employees to deceive them into handing over login information is a common method.

Compromised login details are a huge security risk. Once a cybercriminal is in your systems under the guise of a valid user, they can operate more or less undetected. This leaves them free to steal further data, deploy malware, or take your systems offline entirely.

How many stolen passwords are out there?

In 2020, an audit of several known dark web black markets revealed there were at least 15 billion individual login credentials available for sale. These weren’t only for popular platforms like Facebook and online banks but also private company servers.

The same report found that these domain administrator accounts were auctioned for an average of $3,139, with some going for as much as $120,000. Your business’s authentication data is a target for theft in this context, isn’t it?

If you’re an SME, you’re seen as an easy target. Staff are less likely to be trained in online safety, for one thing. According to IBM, human error is a ‘major contributing cause’ in 95% of data breaches. Password hygiene, multi-factor authentication, and secure login credentials are essential, especially for small businesses.

It’s almost certain that those 15 billion black market credentials included hundreds, maybe even thousands, of businesses like yours.

Medical records, customer documents, and other sensitive information

It’s no secret that sensitive and confidential records like medical documents are a target for cybercriminals. There have been many high-profile healthcare data breaches. In 2015 the second largest healthcare insurer in the US, Anthem Inc, had records of 80 million customers stolen. This irreparably damaged their reputation, which led to Anthem paying a $39 million settlement.

The stolen data contained no medical treatment records. The hackers seized names, dates of birth, addresses, employment information, and Social Security numbers. Why is that important? Because they’re records that almost every company will hold.

The customer information on your database doesn’t have to be medical treatments, criminal records, or personal conversations (like any app with a message function, for example). If your customers, users, or clients leave any personal details in your care, cybercriminals want them.

Which sector is most at risk of customer data theft?

While no treatment records were stolen in the Anthem breach, the fact remains that healthcare is one of the most at-risk sectors. Some estimates claim that as many as 1 in 8 US citizens have had medical records compromised in a breach.

It’s a misconception that the healthcare sector is at risk exclusively because of the sensitivity of medical records. This is only partially correct. It’s also because healthcare is one of the world’s largest (and accessible) industries.

This is why retail and accommodation/tourism are just as vulnerable to data theft as finance, healthcare, and the public sector. E-commerce records aren’t compromising or sensitive, but they exist in abundance. It’s not only sensitive records at risk; any record from any industry is a target.

So, is ANY of my data safe?

The short answer? No. If the message we’re trying to send isn’t clear, all the data your company holds is vulnerable. There are no records or information stored in your data centers that aren’t a potential hackers’ target.

As all cybersecurity professionals will tell you, the question isn’t if you’ll be a target of data theft; it’s when.

Modern solutions for modern threats

Fortunately, it is possible to keep your data secure in 2022. The problem many face is applying 20th-century thinking to the 21st-century threat landscape.

Your data security solution shouldn’t start with the question, “what specifically is at risk.” In so many of the examples above, successful data thieves exploited “low risk” vulnerabilities.

21st-century cybersecurity should be built on a system of assumed risk and total system visibility. Every KB of network traffic could contain the next threat, and every PDF scan, line of code, or customer database is a possible target.

Observability: A Cybersecurity Essential

Keeping all of your data records secure means ensuring the entire system they’re in is observable. That’s why platforms like ours are essential. Almost every data breach we’ve used as an example could have been avoided if the cybercriminals couldn’t operate undetected.

A fully visible system means no hidden blind spots for hackers to exploit. The answer to this piece’s titular question is “all of it.” It’s paramount your security solution reflects this.