The year 2020 alone saw numerous high-profile cybersecurity breaches, including a phishing attack of Twitter employees that enabled hackers to access and tweet from the Twitter accounts of Bill Gates, Elon Musk, and other celebrities. February of this year saw hackers use an outdated computer system to gain access to a Florida water plant and briefly change the levels of lye in the drinking water, threatening public safety. Overall, data shows that the number of records exposed by data breaches increased to 36 billion in 2020, with the three months of Q3 adding an additional 8.3 billion records “to what was already the ‘worst year on record.’” SonicWall, a prominent cybersecurity firm, reported that while malware attacks overall are down, they are nonetheless spreading more quickly than ever before. That’s because they have become more tactical and targeted, and thus have a greater chance of success. Unsurprisingly, phishing peaked significantly around March of 2020, as businesses shifted operations online to accommodate COVID-19 state shutdowns and safety requirements, and ransomware is up 109%.

Consumer Concerns Given this backdrop, and with more transactions online than ever before, consumers have begun to pay close attention to company’s policies on data collection, data protection, and data breach response. In a 2020 survey of consumers regarding the “Building Blocks of Consumer Trust,” the number one most important factor for respondents was protecting their personal data. A whopping 70% of Americans feel their personal data is less secure than it was just 5 years ago, and Julie Brill, the Chief Privacy Officer at Microsoft, noted in her September 2020 Congressional testimony that nine out of ten American consumers now view privacy as a human right.

Implications for Companies While no company can completely eliminate the possibility of a data breach, the industry has come a long way since 1989, when the first use of the term “cybersecurity” was recorded. Today’s top companies have entire teams dedicated to managing site privacy and security, as well as clear policies around privacy and data accessible to employees as well as customers. As cybersecurity threats loom large and encrypted communication gains steam, it is imperative that companies stay ahead of such threats and offer a secure product to their users. This will help modern companies remain competitive and trusted by those they depend on – their customers. In Decrypted Unscripted, cybersecurity consultant David Chamberlin describes best practices for preparing for a potential data breach, as well as steps to take if/when such a breach occurs. First, companies should seek to avoid a data breach to begin with. In addition to offering two-factor authentication, educating your employees extensively about avoiding scams, and installing a robust protection system that maintains data encryption and firewalls, consider establishing a backup location for company/user data. This will ensure that in the event of a ransomware attack, the company can continue to operate essential functions related to this data. If data is sensitive, such as health- related data, consider investing in a cyber insurance policy to cover potential ransomware payouts or other breach-related costs.

Companies should perform internal audits or hire outside firms to evaluate the strength of existing privacy infrastructure and protocol and suggest areas for improvement. In addition, it’s important to have a clear and thorough breach response plan in place that all relevant stakeholders are aware of, and have practiced through a simulation. If a hack or other breach occurs, a well-prepared communications plan can make a world of difference in a company’s ability to brief users and other need-to-know stakeholders appropriately. During a crisis, avoid bringing in new parties, such as a new digital forensics firm or law firm. Instead, vet such partners ahead of time and draw up working agreements so that everyone is already on the same page once it’s time to act. These and other techniques can help to mitigate the financial and branding damage to a company if a breach occurs.