Threats to Data

Every attack has a motive behind it, and the motive shapes what the attacker does. Two motives that are easy to confuse are attacking for fun or for the challenge and attacking for recognition. Neither attacker is usually trying to make money.

Fun and the challenge

Some people attack systems because working out how to get past the security is interesting. The aim is to put their abilities to the test, try out something they have just learned, or prove to themselves what they can do. Others simply want to know whether access is possible at all.

For an attacker like this, the win is getting in. They may take nothing and change nothing once they are inside, because the experience of defeating the security was the whole point.

Recognition and respect

Other attackers want to be noticed. They want people to see what they achieved and to be impressed, so they often choose a target that will be talked about. That might be a large, well-known organisation, or a site that matters to a group they want to impress, such as a fan-run wiki for a cult TV series or a national gaming tournament's leaderboard. Being talked about brings the attacker more attention than breaking into a system nobody discusses.

Because the aim is publicity, this attacker usually wants their success to be seen. For example, someone who gets into a retailer's customer accounts page might post a screenshot of the admin view on a forum, instead of quietly copying members' email addresses.

The motive matters because it tells you what the attacker was after. An attacker chasing a challenge is satisfied by reaching the system, while an attacker chasing recognition needs other people to hear about it – the achievement only counts once it has been seen.

Industrial espionage is the theft of confidential knowledge from an organisation — its business information, trade secrets or intellectual property — so that a rival can gain an advantage from it. The attacker is not after publicity or personal satisfaction; the target is knowledge that another company would pay for.

What gets stolen

• Business information — everyday records that would help a rival, such as a customer list, next season's prices or confidential sales figures.
• Trade secrets — a confidential method or recipe that gives the organisation its edge, such as the process used to make a sports drink or the settings used on a factory machine.
• Intellectual property — designs, inventions and software that belong to the organisation, such as the plan for a new bike lock or the source code of an app.

Why it happens

The motive is competitive advantage. A rival that obtains a design can skip the expensive development stage and release its own version, saving time and money. Stolen price plans let a rival undercut the original company, so customers switch. Sales figures show which customers to approach and what deals to offer. The thief may work for the rival, or may be an outsider who is paid to steal the knowledge.

For example, a company that designs escape rooms is planning three new rooms. A designer copies the plans and passes them to a rival opening in the next town. The rival opens with the same puzzles a month earlier, so the first company loses the customers who wanted to try something new.

This is not the same as breaking in for fun or to show off: there the attacker wants the challenge, while here the information itself is worth something to a rival.

Financial gain is a common motive for attacking a computer system. The attacker wants to make money, either by selling something they have stolen or by getting an organisation to pay them. Financial gain is the motive; stealing data or breaking into systems is how the attacker goes about it.

Extortion means gaining money by force, threats or pressure. In a cyber attack, the attacker demands a ransom — a payment made under threat — and holds on to something the organisation values, such as its data, its systems or its reputation. They may refuse to hand back stolen records, keep control of servers and workstations, or leave a service unusable until the money arrives. For example, an attacker who finds a way into the booking system of a chain of driving schools might threaten to publish how they did it, so that anyone could copy the trick, unless the schools pay. The schools may pay to protect their reputation, keep customers' details safe and avoid the fines that follow a loss of personal data.

Selling stolen data

Stolen data can also be sold, often to organised criminals. That gives the attacker a financial return without the original organisation paying anything. Organised criminals may pay hackers for stolen data because they can use it for fraud and other crimes, so there is a market for the records an attacker can take.

The financial motive shapes the attack. An attacker who wants a payment or a sale may steal records, hold systems to ransom or threaten to release private information. Not every attack is about money — some are for fun, a challenge or a grudge — but a financially motivated attacker is focused on getting paid.

A personal attack is an attack driven by a grudge or personal grievance. The attacker believes they have been treated unfairly by an organisation or by one person, so they want to cause harm, embarrassment or inconvenience. They are not mainly trying to make money.

The attacker might be a customer, a supplier, or anyone who believes the organisation has treated them badly. Because they already know something about how the organisation works, they can spot a weakness that an outsider would miss. For example, someone who has used a bike shop's website has seen that its password reset form asks only for a date of birth. They could use that weakness to get into another customer's account and change the delivery address, which inconveniences the customer and embarrasses the shop.

Sometimes a personal attack is aimed at one person rather than the whole organisation. A member who was removed from a sports club's team might get into the club secretary's email account, because the password is the name of the secretary's dog and everyone in the club knows it. They could then send unpleasant messages to other members. The aim is to upset or inconvenience that individual because of a personal disagreement.

Disruption is any attack that prevents an organisation from operating normally. The attacker's aim is not mainly to steal information: it is to stop services working or to make the organisation's data unreliable.

Disruption usually shows itself in one of two ways. A service can be made unavailable, or stored information can be altered so that staff can no longer trust it.

• An attacker repeatedly enters wrong passwords for a tennis club's court-booking site, so members' accounts lock and they cannot book a court for the whole weekend.
• Someone edits the stock figures for a bike shop so the system claims 40 helmets are in the warehouse when only 4 are there. Staff order the wrong amounts and customers are let down at the counter.

Targets and reasons

Disruption is a reason in its own right: the attacker wants to stop the organisation working, not to steal from it. The target does not have to be a business. A college, a health clinic, government services and political groups can all be disrupted in the same way, because each relies on systems that must keep working.

Disruption can hit organisations of every size. A small charity and a supermarket chain can both be disrupted: their systems simply stop being usable.

What it costs the organisation

Loss of earnings comes first. If a café chain's payment terminals are down for a whole afternoon, customers who cannot pay tend to leave, and some never return. Reputation is the second cost. A service that keeps failing looks careless, so customers may move to a competitor and may not trust that organisation with their details again.

Data and information theft is the crime of stealing data because the data itself is worth something, and it is one of the main reasons a system is attacked. The attacker is not trying to prove they can break in — they want the records held on the system, because those records can be used or sold. Details that point to a real person are the most wanted, since they can be turned into fraud.

A record only has to link a few facts about you to be useful: enough for a criminal to open an account, pass a security check or spend money in your name. Single records are worth little, so stolen data is traded in bulk on a black market, where criminals buy and sell files of records. The person who took the data may never use it; passing it on is the whole point.

Data theft often leads to two other crimes:

• Identity theft — someone uses another person's details to pretend to be them, for example to open accounts or take out credit. The victim usually finds out only when a bill or a refused loan arrives.
• Extortion — stolen data is used to pressure a person or an organisation into paying money. The attacker threatens to release what they hold unless they are paid, so the data is blackmail material.

For example, a tennis club stores details of players, parents and volunteers so it can collect fees. An attacker copies the whole database. One buyer uses a parent's details to take out a mobile contract in that parent's name, which is identity theft. Another buyer emails the club with a page of the records and threatens to publish the lot unless £2,000 is paid, which is extortion. Both crimes harm the people in the records as well as the club.

The aim here is to get hold of the information, not to stop the service running. An attack that mainly stops normal operation is a disruption attack, a separate reason for attacking a system.

An external threat is a danger to a digital system or its data that comes from outside the organisation. An internal threat, by contrast, comes from someone inside it, such as a member of staff misusing their access.

Systems become far more vulnerable when they can be reached from an external network such as the internet. Once a service is online, anyone in the world can try to connect to it, so an attacker no longer needs to be in the building or know a member of staff. A college's internal student records database is only reachable from its own network, but the booking system for parents' evening sits on the internet, so it can be probed by anyone at any time.

The main external threats

• Unauthorised access, also called hacking: someone tries to get into a system when they are not permitted to do so. When this is done with criminal intent it is black hat hacking — for example, repeatedly guessing passwords on a small business's login page from a bedroom to reach its customer records.
• Malware: software written to damage a system, steal data or take control of it.
• Denial-of-service attacks: flooding a service with requests so genuine users cannot use it.
• Phishing: fake messages sent by email, text or phone call to trick people into giving away details.
• Pharming: redirecting a user to a fake website without their knowledge, even when they typed the correct address.
• Social engineering: deceiving people into revealing information.
• Shoulder surfing: watching someone's screen or keyboard to read data such as a PIN.
• Man-in-the-middle attacks: intercepting communication between two devices.

A threat does not have to be deliberate

A natural disaster counts as an external threat too, even though it is not trying to attack anyone. High winds during a storm can bring down a power line, and the resulting surge can destroy a server and corrupt the files stored on it, yet the cause is still outside the organisation. The danger comes from the environment around the organisation, not from a person working inside it.

Malware (short for malicious software) is any program written to damage a device, steal data or make a system carry out actions the owner never agreed to. It is an external threat because it arrives from outside the organisation, and it is usually created for money or to break into systems.

Types of malware

Ransomware is one of the most damaging types. Imagine a small bakery whose till computer holds every order and supplier record: the files are scrambled, a message appears demanding payment for the decryption key, and trading stops until the data is restored. Paying does not guarantee you get the key back, which is why regular backups matter.

How malware hides and spreads

Malware rarely announces itself. A rootkit buries itself in the system files, and a Trojan looks like an innocent download, so an infected machine may keep working normally. Once inside, many types spread to other devices on the same network, so one careless download can affect a whole office.

Malware can reach a device by any route that lets files or data arrive: infected removable media, open or unencrypted Wi-Fi, downloads from an untrusted website, or a malicious email attachment or link. Just receiving a message is not enough, because the harmful program only runs once you open the attachment or click the link. Any device that runs software can be affected, including desktop computers, laptops, phones and smart TVs.

A denial-of-service (DoS) attack is an attempt to stop a service from working by flooding it with traffic. The attacker sends huge amounts of data or requests to a server, so its CPU is always busy dealing with the junk and its network bandwidth is completely full. The attacker is not usually trying to steal data; the aim is to deny access to anyone else.

Imagine a small online shop that prints custom phone cases. If thousands of requests hit its web server every second, real customers just watch a loading spinner and then get an error page. Their orders never go through, so the shop loses sales and looks unreliable, even though nothing was actually broken.

Distributed attacks

In a DDoS (distributed denial-of-service) attack, a botnet is used: many compromised computers are commanded to send requests simultaneously to one target. A botnet is many infected machines working together, not a single computer.

The owners of those computers usually have no idea. Their machines were infected with malware that quietly sits in the background and waits for instructions from the attacker, who controls the whole botnet remotely. A school laptop, a home PC and a smart TV could all be part of the same botnet.

Why DDoS is harder to stop

With a single-source DoS attack, a technician can often spot the one address sending all the traffic and block it. In a DDoS attack the requests arrive from hundreds or thousands of different addresses in different locations, so blocking one makes almost no difference. The technician cannot block every address, so the server stays overwhelmed and the attack is much more likely to succeed.

A man-in-the-middle (MITM) attack is when an attacker secretly places themselves between two devices that are communicating. The attacker receives the data travelling in both directions, so the two devices believe they are talking directly to each other.

For example, imagine you send a message to a friend saying "meet at 4pm". If an attacker is in the middle, they can read that message and change it to "meet at 6pm" before passing it on. Neither you nor your friend knows the message was intercepted or altered. The attacker may also tamper with the data in other ways, such as changing a file or a login request, without either party knowing.

Reducing the risk

Encryption scrambles data so that it becomes unreadable without the correct key. It does not stop an attacker intercepting the data, but it stops them being able to decode and read it, so anything they capture is useless to them.

A VPN (virtual private network) creates an encrypted tunnel between your device and the VPN server. Even if your data is intercepted, it cannot be decoded and read. Both measures therefore make a man-in-the-middle attack harder to carry out successfully: the attacker may still capture the data, but it is useless to them.

Shoulder surfing is watching someone's screen or keyboard to see what they are typing or reading. The attacker can be standing close by, or watching from further away with a clear line of sight.

The aim is to read sensitive data such as a password, a PIN or a username as it appears on screen or is keyed in. Once the attacker has those details they can sign in as that person, and the victim has no idea their details have been seen.

Why it works

• Nothing is broken into and no software is used, so there is nothing for security software to detect.
• People often type openly in public places, in queues or in shared rooms, without checking who can see.
• The attacker only needs a moment: a PIN is a few digits and a password is typed in seconds.

Shoulder surfing is not hacking. A hacker uses technical skill and tools to break into a system, whereas a shoulder surfer simply uses their eyes, so a strong password and a firewall do nothing to stop them seeing what is typed.

Worked example

Arun taps his four-digit PIN into the keypad of a locker at a leisure centre. Someone nearby pretends to read the pool timetable but watches the digits being entered. While Arun is swimming, that person opens the locker and takes his wallet.

The same risk appears when a password is shown on a tablet screen at a busy youth club, or when a school login is displayed on a monitor that faces a corridor.

Social engineering is tricking a person into revealing sensitive information, such as usernames, passwords or personal details. Instead of attacking the technology, the attacker tricks a person into handing over a way in.

It works because people are helpful and because they trust anyone who sounds official or who appears to be in trouble. A social engineer often impersonates someone — a delivery driver with a parcel for a named member of staff, a contractor checking fire alarms, or a quiz organiser collecting entry forms. A small request from someone who seems to belong is hard to refuse, especially if it is framed as urgent.

How it reaches you

Phishing is a type of social engineering.

The victim may not notice

If social engineering succeeds, the victim often does not realise they have revealed anything. No lock was forced and no password was guessed, because the details were handed over willingly and the request seemed ordinary. Often the person only finds out later, when an account starts being used by someone else or a payment appears that they never made. That delay gives the attacker time to use the information before the password is changed.

Tailgating

Tailgating, also called piggybacking, is a face-to-face social engineering technique in which an unauthorised person follows an authorised person into a restricted area. For example, at a leisure centre, a swimmer without a coloured wristband walks through the poolside gate behind a family who scanned theirs. The gate records one family entry, so the system shows nothing unusual, and nobody questions a person who is already inside.

Phishing is a very common form of social engineering: the attacker sends a spoof message that looks as though it comes from somebody you trust, such as your school, a game's support team or a delivery firm. It is fake, but it is designed to look genuine so that you act without stopping to check.

The aim is to make you click a link and land on a fake website that copies the real one. Anything you type in, such as a username, password or card number, goes to the attacker, not the real organisation. A text might say that photos from a school trip are ready and ask you to sign in with your school account; the page looks exactly like the normal school login, so your password goes to the sender.

How it reaches you

Phishing is not only an email problem: it can also arrive as a text message, as a phone call from someone claiming to be a company, or face to face.

Warning signs

• Spelling and grammar errors, because real organisations check their messages.
• Website addresses that are slightly wrong, perhaps with an extra word or a different ending.
• Link text that does not match the address the link really points to.
• A greeting addressed to "customer" rather than to you by name, showing it was sent to many people at once.
• Pressure to act quickly, such as a warning that your account will be locked unless you sign in again.

Check the sender's address, and if you are unsure, contact the organisation using details you look up yourself. A genuine organisation is unlikely to ask for your password by email.

Reducing the risk

Spam filters catch many phishing emails before they reach an inbox, but some always get through. If one does, do not open attachments or click links. Scan any file with anti-virus software, then delete the message and report it.

Phishing is not malware: the message itself does not infect your device. It works by tricking you into giving information away, so spotting the signs is your best defence.

Pharming is a cyberattack that redirects you to a fake website which looks just like the real one. You might type the correct address of a site you trust, yet still land on a copy made by an attacker. The fake site is convincing, so you enter your username, password or card details without suspecting anything. Pharming is similar to phishing, because both trick you into typing personal details into a website that only looks legitimate. The difference is how you get there: with phishing you are usually persuaded to click a link, whereas with pharming you are sent to the fake site even when you typed the right address.

How the redirection works

A DNS server is part of the Domain Name System, which translates a website name into its IP address, the number computers use to find each other. When you type a name such as bookbarn.example, your device asks a DNS server for the matching IP address, then connects to it. If an attacker compromises a DNS server, they can change the answers it gives.

For example, suppose a college's DNS server is altered so that requests for the student portal are answered with the IP address of an attacker's server. Every student who types the correct name is taken to the attacker's copy of the login page. The address bar shows the real name, so nothing looks wrong, and the students type their logins into the fake page. The attacker collects them and can then sign in as those students.

Why it is called DNS spoofing

Pharming is also called DNS spoofing because the DNS server is made to give a false answer that pretends to be genuine. You cannot spot pharming by checking the web address carefully, because the address shown is correct. Pharming is not a kind of malware: it is a technique that relies on a compromised DNS server, set up so that many users are redirected at once rather than one person at a time.

An internal threat is a risk to digital systems or data that comes from inside the organisation. It is not an outside attacker breaking in: it is a danger created by someone who already has some kind of access, such as an employee or a contractor working on site. Because that access already exists, the organisation's outer defences may never be tested at all.

Accidental or deliberate

Accidental threats come from mistakes and human error. Nobody means any harm, but data can still be lost or exposed. Deliberate threats are carried out on purpose, usually by someone who already has access and who decides to cause damage or make money.

The difference matters because the two are tackled in different ways: accidents are reduced mainly by training and clear procedures, with backups limiting the damage when they happen, while deliberate action is reduced mainly by limiting what each account is allowed to do and by watching for unusual activity.

Why they are taken seriously

An insider usually understands how the system works, holds a valid username and password, and knows which files hold the valuable records. That makes them just as dangerous as an outsider, sometimes more so.

For example, a ticket clerk at a small theatre has a login for the booking system. Whether they wipe a block of bookings by accident or copy the customer list on purpose, the firewall never comes into it: the harm is done with a valid account.

One insider can therefore cause serious data loss, financial loss or damage to reputation. Organisations need comprehensive security rather than a firewall alone: staff training, clear policies, appropriate user access levels, monitoring, backups and physical security all help to reduce internal threats.

A deliberate internal threat comes from somebody who already has — or once had — a legitimate reason to be on the system: a member of staff, a contractor or a temporary worker who chooses to cause harm or to gain from it. This may be someone who feels unfairly treated, or simply someone who sees a chance to make money. An accident, such as pressing the wrong button, is not a deliberate threat, because nobody meant the damage to happen. The weak point is often access: an account left open when a contract ends lets a person carry on after they have gone.

Destroying records and stealing money

An insider can delete or alter records far more easily than an outsider, because they know which files matter. A warehouse supervisor might delete or change delivery records after stealing stock, so the missing items cannot be traced. Money is just as easy to take: someone with payroll access can add a fake employee and have the wages paid into an account they control.

Stealing or leaking information

Copying information and taking it out of the organisation is another internal threat. It can continue for months because the insider is allowed to open the files. People do it for cash, to get back at a manager, or to support a political or social cause. Selling trade secrets to a rival business is industrial espionage, and the insider often gains money or a job from it. The result is the same: confidential information ends up with someone who should never have had it.

Malware from an internal source

Malware introduced from an internal source can collect confidential information and send it outside the organisation. A staff member with access to a shared computer could install a small program that copies every file in the finance folder to an online storage account they control. Because the machine is inside the network and the program runs under a normal staff login, the traffic can look ordinary, so a firewall on the internet connection does not stop it.

Unintentional disclosure of data is when confidential or private data is seen by someone who should not see it, even though nobody meant any harm. It is an accidental internal threat: the person who lets the data out works inside the organisation and had a valid reason to be using that data in the first place.

Misdirected communication

Most cases come from misdirected communication — sending something to the wrong place. At a college, a finance officer emails the monthly budget to the principal but attaches the staff salary spreadsheet by mistake. The same slip happens with storage: a head of year saves a file of pupil support plans to the department's shared drive instead of the restricted folder, and every member of staff with access to that drive can open it.

Printing is the easiest version of all. A report sent to the office printer rather than the one in the staff room sits in the tray until the next person to walk past picks it up.

These mistakes happen because the sender is rushing and the software does not check anything for them. Once send is pressed, the file has gone and cannot be pulled back.

Other staff seeing screens and passwords

Shoulder surfing means reading information by looking at someone else's screen or watching them type. Many people picture a stranger on a train, but a colleague is just as real a threat, because they already have access to the building and may pass your desk during the day. Passwords leak in the same quiet way: written down and kept in an unlocked drawer, or typed in while someone is waiting beside you.

Why it matters

Disclosed data rarely stops with the first person who sees it. It can be forwarded on to others, used by another organisation, or sit on a shared drive for months without anyone noticing. The people named in it can be embarrassed, targeted by scammers or left at risk of identity fraud, and the organisation can then face complaints, a fine from the information regulator and lasting loss of trust.

Staff cut the risk by checking the recipient and the attachment before sending, locking the screen whenever they step away, fitting privacy filters to laptops, never writing passwords down and following clear policies for confidential data.

Accidental deletion is an internal threat because data is removed by someone inside the organisation who makes a mistake, not by an outside attacker. It often happens because of incorrect access permissions: a member of staff can delete files or records that they only need to read or update. For example, a receptionist at a dentist's surgery has permission to delete old appointment records. While clearing space, they delete the whole month's appointments instead of only the cancelled ones, so the practice loses the schedule and must contact patients.

It can also happen through a lack of training. If you have never been shown how to save a new version, you might open an important file, type over it and save, wiping the original. Training and sensible permissions reduce the risk: staff should only be able to delete what their job needs, and they should know how to save and back up work.

Accidental physical damage is another internal threat. Equipment can be damaged by careless handling by someone inside the organisation. For example, a teacher wheels a heavy trolley into a charging laptop, snapping the power connector. The laptop cannot be used, repairs cost money and work is delayed while it is fixed. Organisations reduce this risk by training staff to handle equipment carefully and by keeping backups, so a damaged device does not mean the only copy of the data is lost.

Overriding security controls is an internal threat: someone who already has access to an organisation's systems bypasses a protection that is there to keep systems and data safe.

They may do this to reach data they are not allowed to see, because they find a control inconvenient, or because they think they know better. For example, a staff member might share an administrator password, turn off antivirus or a firewall, install software the organisation has not approved, or remove access restrictions from a folder.

How it leads to harm

Overriding a control can let malware spread or let data be accessed. If a staff member disables antivirus to install an unapproved game, malware in that game can run and encrypt files on the computer, including work documents. If a staff member removes access restrictions, other people can open files they should not see. Using an administrator password that is not yours lets you change settings and weaken security.

The user may not intend harm, but the protection is missing while they work, so the effect is still a security risk. The risk is clearest when you name the control being bypassed and explain what happens next: disabled antivirus lets malware run and encrypt work files, or removed restrictions let unauthorised staff read records.

Poor security practices create internal threats through how staff use passwords, updates and logins. They are often accidental rather than deliberate, but they can still let an unauthorised person reach systems and data.

Passwords

A weak password is short or easy to guess, such as a pet's name or 123456, so someone can keep trying likely choices until one works. A shared password is used by several people for one login: if one person reveals it, everyone's access is exposed, and changes cannot be traced to an individual. An unprotected password is written on a note or saved where others can see it. For example, a shared login for a sports club's booking system means a volunteer who learns the password can sign in as the club secretary and change bookings.

Updates and open sessions

Security software and operating systems need updates because updates often fix known weaknesses. If staff ignore them, those weaknesses stay open and can be exploited to gain unauthorised access. Logging out matters because an open session lets the next person act as that user, which can include changing security settings.

Organisations reduce these risks with clear policies, strong password rules, automatic updates, screen locks and training.

A portable storage device is storage hardware that you can carry around and plug into a computer, such as a USB flash drive, an external hard drive, a memory card or a smartphone used to store files. Using one at work is an internal threat because the danger comes from a person already inside the organisation, not from an outside attacker breaking in.

Introducing malware

When a device is connected to an organisation's computer, any malware stored on it can run or spread onto the network. A staff member may plug in a device that picked up malware on a home computer or another machine, and the malware travels with it onto work files and other machines.

Loss and theft

Portable storage devices are small, so they are easy to leave behind, drop or have stolen. If a drive holding personal data about patients, pupils or customers is lost, the data can be read or used by someone else. This is a data exposure risk even when the staff member did not mean any harm.

Device failure

Portable devices have a short lifespan. Flash memory can only be written to a limited number of times, and a hard drive's moving parts wear out, so a device can stop working after repeated use and without warning. If the only copy of a file is on that device, the file is lost.

For example, a coach at a community sports club keeps players' medical details and emergency contacts on a smartphone so they can be checked at away matches. The phone is left on a bus, so the club loses the only copy of those details and cannot control who reads them.

Unsafe internet use is an internal threat because staff already have some access to the organisation's systems, so what they download, visit or open can bring malware inside or lead them into a phishing trap.

How the risk gets in

A download from an unofficial source can hide harmful software. For example, an employee may download a free file-conversion tool from an advert instead of the official supplier, and the installer also places malware on the computer.

A visit to an untrustworthy website can install malware or show a fake login page designed to steal details. Harmful links and attachments also arrive in email, chat apps and text messages. Receiving a message is not enough on its own: someone has to click the link or open the attachment before the malware can install.

Signs a website is untrustworthy

These signs matter because they show the site may be trying to trick you, or may not keep your data safe.

Reducing the risk

Organisations use filtering to block known bad sites, scan incoming mail for harmful links and attachments, train staff to check addresses and padlocks, and set clear rules about what can be downloaded and from where. Together these make it harder for an internal mistake to become a malware infection.

A security breach is when someone gets into a system or data without permission. Its impact is the harm that follows, and that harm lands on two different groups: the organisation that holds the data and the clients or customers whose data is affected. Keep the two apart, because the same breach hurts each in a different way.

Short-term and long-term

Some impacts appear straight away. A gymnastics club's booking system may be shut down while staff check a suspicious login, so parents cannot book classes and the office spends the day answering calls. That short-term downtime also stops the club taking payments. Other impacts build over weeks or months: paying for extra security checks, or members leaving because they no longer trust the club. These longer-term effects are often harder to repair than the technical fault.

Impacts are linked

Impacts are not a checklist, because one usually leads to another. If contact details are lost, customers may get scam messages that look genuine; staff then have to warn them and answer questions, which reduces productivity and damages public image. In the same way, if downtime stops staff updating stock records, the website shows sold-out items as available, customers order them and later ask for refunds, which becomes a financial loss.

So when you explain a breach, follow the chain: the impact, who it hits, then the consequence.

Data loss happens when data is destroyed, corrupted, stolen or made unavailable, so the organisation can no longer use it. The loss may be permanent: with no usable backup, the records are gone for good.

For example, a community theatre group keeps members' contact details and ticket bookings in a single database. A staff laptop holding the only copy is stolen. Nothing has been deleted, but the records are lost to the group and may now be in a thief's hands. If a power cut corrupted the database instead, the records might still exist but be unreadable — that is data loss too.

Stolen data still counts as data loss, even when a copy exists, because the organisation has lost control of who can see it. Data loss is about the data itself, not the system: a website can stay online while the records behind it are corrupted or missing. Systems being unavailable is downtime, which is a different impact.

Impact on the organisation

Data loss can lead to loss of clients. If members and ticket buyers hear that their names, addresses or card details have been lost or stolen, some will stop renewing and take their bookings elsewhere. It can also damage the organisation's public image: a story about missing customer records makes an organisation look careless, and that impression spreads quickly, so new customers choose someone else.

The two impacts are linked. Once the group no longer controls who can see its records, it also loses control of how it is seen, and rebuilding a good name takes far longer than restoring a backup.

Damage to public image is the harm a security breach does to the way people view an organisation. You may also hear it called reputational damage, loss of trust or a loss of confidence. Even after the technical fault has been fixed, customers and the public may stop believing that the organisation keeps data safe.

Existing and potential customers

People already using the organisation may take their business elsewhere: someone who shared personal details may feel let down and switch to a competitor. New customers can be put off too, because hearing about a breach makes them decide the risk is not worth it. For example, a chain of after-school coding clubs holds children's names, addresses and details of allergies or medical needs. If those records were exposed, some parents would move their child to a different club, while parents new to the clubs would pick a rival.

Why the damage can last

A technical fix closes the weakness, but it does not reset what people believe. Trust is built slowly and can be lost quickly. Customers may keep wondering whether more of their information will appear, and may watch the organisation more closely than before. That is why damage to public image can outlast the repair itself: the organisation can look unsafe long after its systems are working normally.

Financial loss is money an organisation loses because of a security breach. It is not only the amount of a fine: it also includes the cost of putting things right and the income that stops coming in.

Cost of sorting out the breach

Fixing a breach costs money even before any fine. Investigators may be brought in to work out how the attacker got in and which records were reached, and specialist IT staff may be paid, either from inside the organisation or hired for the clean-up. Extra secure storage may be rented and new monitoring software licensed while the problem is dealt with. The organisation also has to contact everyone affected, which can mean letters, emails and a helpline.

For example, a small online ticket agency finds an attacker has opened its customer database. It pays a security firm to investigate, pays two technicians overtime to reset every customer password, and posts a letter to 6,000 customers because the email addresses held can no longer be trusted. Each of those is a financial loss, even though no fine has been issued.

Income lost while trading normally is impossible

Money the organisation would have earned but cannot is also financial loss. While it cannot take payments or send out orders, customers may buy from a competitor instead, and some will not come back, so the loss can carry on after systems work again. Staff still have to be paid, so costs continue while income falls.

Penalties and legal costs

A fine from a regulator, lawyers' fees and compensation paid to affected customers are added on top. Legal costs can be large even if the organisation wins, because advice and representation have to be paid for.

Financial loss is often short-term, such as one large bill for an investigation, but it can carry on for months as legal cases are settled and customers are won back.

Reduction in productivity means less useful work is completed in the same amount of time. It happens after a security breach when staff cannot work normally. For example, staff logins may be suspended while passwords are reset, so people cannot open the software they need to do their jobs.

Staff may then be idle while they wait for access to return. Others may have to re-enter lost data from paper records or memory, which is slow and can introduce mistakes that then need checking. Some may use slower workarounds, such as writing orders on paper, phoning customers to check details or using a different device. Staff may also be pulled away from their normal duties to help with the investigation, for example by explaining what they saw or checking which files were accessed.

The work still has to be done, but it takes longer. Staff are still at work for the same hours, but less gets done: fewer orders are processed, fewer customers are served or fewer jobs are completed. The backlog can take weeks to clear, so output stays low even after systems are back online. This affects the whole organisation, not just the IT team: reception, sales, warehouse and finance staff can all lose time.

For example, a bike repair business with three workshops has its booking system locked during a breach. Mechanics cannot see today’s jobs, so they wait or phone customers to confirm details. Office staff re-enter bookings from paper notes and help the IT team check which accounts were accessed. Fewer repairs are completed that week, and the missed jobs have to be fitted in later.

Downtime is a period when a computer system is unavailable, so nobody can use the service it provides. During a security breach it is often a temporary, complete loss of service: the equipment is still there, but staff and customers cannot log in, view records or place orders.

Why a breach causes downtime

When an organisation discovers a breach, it needs time to investigate and fix it. The system may be deliberately shut down to stop malicious software spreading or to stop an attacker reaching other accounts. Staff might disconnect the network, check logs, remove the attacker's access, reset passwords and restore a clean backup. Until that work is finished, the service stays offline.

What happens during downtime

While systems are down, an organisation may be unable to operate normally or complete customer orders, so customers wait and income is lost. For example, a bicycle repair workshop uses one system for bookings, spare-part stock and card payments. If the system is switched off during an investigation, mechanics cannot check whether a part is in stock, and counter staff cannot take card payments or print collection notes. Repairs stall and orders wait until the system is available again.

Downtime is not the same as data loss: downtime is about the system being unavailable, not about data being lost, stolen or corrupted.

Legal action is an impact of a security breach where an organisation can be punished for failing to protect customer data or for breaking data protection law, such as the Data Protection Act or GDPR. It is not just a warning: it can lead to the organisation being fined, taken to court or sued. Legal action does not have to involve the police or a criminal case; it usually means a regulator or a customer taking action against the organisation.

The Information Commissioner's Office (ICO) is the UK regulator for data protection. It can investigate an organisation and, if it finds the law has been broken, issue a fine and take the organisation to court. It can also serve an enforcement notice ordering the organisation to change how it handles data, for example by improving security or deleting data it should not hold. Individuals whose data was affected can sue the organisation, asking for compensation for the harm or distress the breach caused.

Why it matters

Legal action is a serious impact because it combines money lost through fines and compensation with damage to the organisation's reputation. It also forces staff to spend time dealing with lawyers, investigations and legal requirements instead of normal work.

For example, a holiday club that runs activity days for children holds medical details and emergency contacts. After a breach exposes these records, the ICO finds the club did not protect the data properly. It fines the club and orders it to change its security, and some parents sue for distress and receive compensation.

When a security breach means that the personal data of clients or customers has been accessed, compromised or leaked, the harm does not stop at the organisation. The people whose information was held can face serious and lasting consequences.

Stress and loss of trust

Finding out that personal details such as addresses, payment details or medical notes have been seen by someone who should not have them can be very stressful. Even if the data is not misused, not knowing who has it causes worry. Customers may lose trust in the organisation and stop using its services. In serious cases they may take legal action against the organisation, arguing that it failed to keep their data safe. For example, a customer of a ticket booking website might feel anxious after their card details are exposed and join a claim against the company.

Identity theft

Stolen personal data may be sold to criminals. With enough details, someone can pretend to be the customer and apply for credit or open accounts in their name. This is identity theft. The customer may only find out when an unexpected bill arrives or a genuine application for credit is refused. For example, after a breach at an online pet supplies shop, a fraudster uses a customer's leaked name, address and date of birth to set up a broadband contract in their name. The customer only finds out when a bill for a service they never ordered arrives.

Time, effort and hardship

Sorting out the consequences can take a lot of time and effort. A customer may need to contact their bank, change passwords on many accounts, check statements for unfamiliar payments and prove their identity. This can cause hardship, especially if money is taken or their credit rating is affected. For example, a parent might spend several evenings calling their bank and a credit reference agency after a breach at a children's sports club.