A guide to preventing data breaches

In 2022 alone, more than 422 million Americans¹ and 83% of global businesses² fell victim to data breaches. For cybercriminals seeking customer payment data, financial services companies and insurance firms are often the prime targets.³

This is far from a minor irritant or inconvenience. According to a report from IBM Security, the average cost of a breach in 2023 was $4.45 million – an all-time high, covering ransomware payments, lost revenue, legal fees, audit costs and more.⁴ And it’s getting worse – between 2022 and 2023, the cost per breach for businesses with fewer than 5,000 employees increased by a huge 20%.⁴

Understandably, breaches are a major turn off for consumers: a data privacy platform found that 80% of consumers will disassociate from a brand after a breach.⁵ As well as losing customer trust, businesses may also face higher borrowing costs, and some could have to raise their prices.

But help is at hand – here’s a few tips on how to prevent data breaches so businesses can be more empowered to prevent data theft.

Understanding the data breach landscape

• Ransomware. This is one of the most common data breach methods, where hackers demand a ransom for stealing private data.
• Malware. Malware is any kind of software designed to harm, disrupt or gain unauthorized access to a system, and can include hackers getting access to sensitive customer data.

• Social engineering. Phishing, for example, relies on employees clicking a link in a fraudulent email or tricking them into downloading malware. A cybersecurity firm found that 25% of employees have noticed an increase in phishing attempts since the onset of the pandemic, and an estimated 50% of data breaches use phishing as their way in.⁶

• Network and software vulnerabilities. Hackers sometimes exploit a long list of elements of a company’s tech stack. Apps, public websites, servers, software, and hardware may all be penetrated to reveal customer names, social security numbers, and credit card numbers. POS systems, databases, payment gateways and other third-party software with low security may also put retailers at risk; employees’ personal devices could also help hackers access customer data.

• Compromised credentials. Hackers sometimes impersonate employees to gain access to business accounts. Statista data shows that poor password hygiene was one of the top causes of various types of data breaches in 2022.⁷

Building a strong security foundation

Robust security infrastructure could help to prevent hackers from accessing sensitive data, help organizations understand and detect threats, and – should the worst happen – provide strong audit trails. Businesses with comprehensive cybersecurity policies and processes and fast detection tools will find it easier to recover faster from a data breach.

Firewalls may be the first line of defense. They can prevent some malicious actors from gaining access to a sensitive data environment. Keeping software up to date, working with reputable third parties, and using intrusion detection systems could also help to make a business more resilient to theft.

Employee training and awareness

The three most common employee mistakes leading to a cyber incident in 2022 were poor password hygiene, misuse of personal email, and oversharing on social media, according to Statista.⁷ Keeping employees informed may help prevent breaches, particularly by prompting teams to update passwords regularly and to be vigilant against phishing attempts.

Secure data handling and storage

Norton cybersecurity claims that a single credit card number can be sold for up to $110 on the dark web.³ Secure payment processing methods could protect customer card data during transactions, reduce identity fraud – and keep customers out of this marketplace.

In 2023, cybercriminals accessed four years’ worth of customer purchase data stored by a retailer.⁸ Breaches of this scale highlight the importance of a data handling and storage policy; data is safest when encrypted, tokenized, and erased after a specific time period to reduce risk, as IBM shows.⁴

Access control and authentication

Harvard reports that over 80% of data breach methods require an external actor.²

Effective access controls include two-factor authentication, audit trails, and role-based permissions. A recent study states that nearly two-thirds of financial services businesses have more than 1,000 sensitive files accessible to all staff, with retailers facing similar risks through third-party POS systems and sales apps.¹⁰

Regular software patching and updates

Businesses could discourage hackers from exploiting vulnerabilities in outdated software by keeping digital environments up to date. Updating and patching systems is a Payment Card Industry Data Security Standard (PCI DSS) requirement - this includes browsers, firewalls, applications, software, databases, POS systems, and operating systems.

Monitoring and detection

Another PCI DSS requirement is the continuous monitoring of data environments. This includes intrusion detection, threat detection, and real-time event monitoring. According to IBM, businesses using AI and automated security solutions could detect data breaches as many as 108 days faster than businesses that don’t.⁴

Incident response plan

A well-defined incident response (IR) plan may help organizations restore data, repair damage to systems, and identify the source of a breach. IBM’s research shows organizations with an IR plan and a dedicated IR team identified breaches 54 days faster than other businesses, a faster pace that reduced the cost of a data breach by an average of $232,008.⁴

If a data breach does occur, some courses of action to be taken is to:

• Identify the source
• Investigate the cause
• Conduct an immediate clean-up
• Analyze what it can do to prevent another breach
• Actively communicate with customers to restore confidence

Vendor and third-party risk management

When a vendor or service provider is hacked, the businesses it works with are also at risk. Third-party risk data reveals that retailers of all sizes could be vulnerable.⁸

To prevent this, businesses could set clear expectations for how data will be stored and managed, continually monitor the activity of third parties, and choose vendors that independently verify and test their security environments.

Compliance and regulations

Complying with industry regulations and standards could enhance data breach prevention.

It’s best practice for any business managing customer payment data to comply with the PCI DSS. Merchants may also be subject to other laws and acts, so it’s important to do research.

Building customer trust

72% of American consumers surveyed said they would not make a repeat purchase with an online retailer that mishandles their data.⁹ This wariness is understandable, given the target these businesses can offer hackers seeking payment data.

Merchants could win consumer trust by communicating clear data policies and being transparent about third-party access. Investing in data security could reassure customers that privacy and security are taken seriously.

Explore PayPal’s business solutions to discover how businesses can accept secure payments online and in person, track sales, simplify shipping, and manage risk.