When most executives discuss data breach threats, often issues like financial loss due to customer dissatisfaction and diminished brand reputation are top of mind. However, it is a common misconception that data breaches are solely consumer-focused. Recent incidents in particular illustrate hackers are targeting a wider variety of valuable information – including employee records.
The potential impact of an employee data breach cannot be overlooked. From personally identifiable information (PII) to financial and healthcare records, username credentials and even potentially sensitive email exchanges and intellectual property, employee records represent a plethora of valuable information. Furthermore, a company’s employees are arguably their biggest asset, and must be treated differently than external audiences. If employee records are lost in a data breach, it is important that there is clear communication at the onset to help deter confusion, loss of productivity and potential turnover. Consider that employees are much more invested in the company as it is not as easy to make a change like it is for a consumer who can simply shop at another retail store or move their accounts to a different bank. Employees will be more engaged and have even higher expectations to be protected if they are impacted by a breach.
With all of this in mind, security professionals are advised to rethink what it means to prepare for a data breach. Organizations that update their incident response plan to outline clear steps for managing the potential loss of employee data are best positioned to lessen the resulting fallout. This includes making adjustments both from an IT security perspective, and preparing to work more frequently with HR in order to be on the same page about communication with employees.
1. Consider Data Sensitivity
The sensitive nature of employee records is second only to children. Because of the unique information housed within HR, it allows for the potential exposure of a wider range of information during a data breach. As such, CSOs should consider having their company retire old data and store information in different locations. Have a clear understanding of precisely what information is stored in various databases, and keep in mind that if data from former employees is not deleted, they may also be impacted and need to be notified in the event of a data breach.
2. Know Your Audience and Partner with Human Resources
A company’s relationship with employees is critical because they are expected to be advocates for the organization outside the workplace. Security executives should be involved with how their organization communicates to employees in an upfront and personal manner by leveraging resources such as town hall discussions and internal question forums. This means working closely with the HR department as part of the data breach response team, and anticipating potential employee questions. In the event of a data breach, it is important to educate employees about what they should and should not discuss about the incident outside of company walls, in addition to providing clear guidance on how they can protect themselves.
3. Be Prepared for Strong Engagement
Previous employee data breaches have shown us that employees are more concerned and responsive than customers when they are impacted by a breach. Therefore it is important ensure call centers and online forums are prepared for a higher volume of activity if a data breach of this type occurs. As with any incident involving the loss of a person’s data, it is also necessary to provide identity theft protection services.
As the frequency of cyberattacks and types of data loss continue to increase, security professionals are challenged with continually expanding their remit. In the case of employee data breaches, it is important to work closely with HR as part of the data breach response team to ensure a company is prepared to provide clear guidance to employees in the event of an incident. This will help maintain employee trust and limit the potential for resulting class action lawsuits or employee churn.
More information and guidance on how to prepare for a data breach are covered in the Experian Data Breach Resolution blog.
