TL;DR: Data Breach News, November 2026, and What Small Businesses Should Fix Now
Data breach news in November 2026 repeats a familiar story. Reused passwords, hacked suppliers and unpatched software cause costly breaches, and you can cut your own risk in 30 days without a security team.
- Small companies are the favorite target. Verizon's 2025 report found ransomware in 88% of small and mid-sized business breaches. IBM puts the average breach cost at $4.44 million globally and $10.22 million in the US.
- Seven threat patterns keep showing up:
- supplier breaches
- ransomware that steals data
- stolen logins and infostealer malware
- shadow AI, which adds up to $670,000 per breach
- open cloud folders
- Black Friday phishing (November 27)
- stricter EU rules such as NIS2, DORA and the Cyber Resilience Act
- Your 30-day protection plan:
- Week 1: add a password manager, MFA and automatic updates.
- Week 2: map your data, delete what you don't need and lock sharing settings.
- Week 3: limit access, write an AI usage rule and get vendor breach terms in writing.
- Week 4: set up offline backups, a one-page incident plan and a team drill.
- In the first 24 hours after a breach: isolate devices without wiping them, reset credentials and call your lawyer and insurer. Keep a written timeline. GDPR gives you 72 hours to notify the authority.
Old accounts are a real danger. A 12-year-old test account with the password "Password1" opened the door in the Ogi Networks ransomware case, so run your own Password1 audit. If a vendor gets hit, follow this supplier breach guide to handle the first 72 hours.
Author Violetta Bonenkamp (Mean CEO), founder of CADChain and Fe/male Switch, warns that hiding an incident or paying a ransom without advice can sink a startup faster than the breach itself. Turn on MFA for your email, bank and cloud storage today so the next breach headline you read is about someone else.
Check out other fresh startup news and trends that you might like:
Semiconductor News | November, 2026 (STARTUP EDITION)
Data breach news in November 2026 reads like a repeat of every other month, and that is exactly the problem. The company names change, the record counts change, the apologies get copy-pasted, and small business owners scroll past thinking “that only happens to big brands.” I am Violetta Bonenkamp, better known as Mean CEO, and I run several European ventures in parallel, including CADChain, a deeptech company that protects intellectual property inside CAD files, and Fe/male Switch, a game-based startup incubator for women founders. Both companies handle data that criminals would happily steal, so I read breach reports the way a pilot reads crash investigations. This briefing gives you the patterns behind this month’s headlines, the numbers that matter for small companies, a 30-day protection plan, and the mistakes that turn a minor incident into a company-ending event.
One honest note before we start. Breach headlines shift hourly, victim counts get revised for months, and early reports are often wrong. So instead of copying a list of names that will look different by next week, I focus on what keeps showing up in every report, what the trusted research says, and what YOU should change in your business before December. Let’s break it down.
What counts as a data breach in November 2026?
Founders often use “hack,” “leak,” “incident,” and “breach” as synonyms. Regulators do not, and the difference decides whether you have a legal duty to notify customers. The Wikipedia overview of data breach definitions summarizes the common definition as “the unauthorized exposure, disclosure, or loss of personal information.” The US National Institute of Standards and Technology (NIST) goes wider and includes anything that “actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system.” The UK National Cyber Security Centre keeps it short: a breach happens “when information held by an organisation is stolen or accessed without authorisation.”
Those three properties form the CIA triad, which in security means Confidentiality, Integrity, and Availability. It has nothing to do with the intelligence agency. The Proofpoint guide to data breach meaning and prevention explains that a breach compromises at least one of these three elements. It also gives a ladder I use with my teams:
- Security incident: any activity that puts the privacy, integrity, or availability of data at risk.
- Compromise: attackers get into systems or accounts without permission.
- Data breach: attackers access, steal, or publish private information.
- Data leak: information gets shared unintentionally, usually through a misconfigured database. Nobody has to be malicious.
- Data exposure: information sits open to the public internet but nobody has proven it was accessed.
Proofpoint puts it neatly: “while not every incident turns into a breach, every breach starts as an incident that escalated.” That sentence should live on the wall of every startup office. Also, the IBM explainer on what a data breach is clears up a common confusion. A DDoS attack (Distributed Denial of Service, which floods a website with traffic) that knocks your site offline is NOT a data breach. A ransomware attack that locks customer data and threatens to publish it IS a breach. The physical theft of a laptop, a USB stick, or a box of paper files with sensitive information counts too.
What counts as “personal information” for breach laws?
According to the National Association of Attorneys General page on data breach laws, all 50 US states, the District of Columbia, Guam, Puerto Rico, and the US Virgin Islands have breach notification laws. Personal information typically means a person’s name plus one or more of these:
- Social Security Number
- Government ID card number or license number
- Account, credit card, or debit card number combined with a security code, PIN, or password
- Medical history or health information
- Biometric information
- Email address and password
- Tax ID number
In Europe, the General Data Protection Regulation (GDPR) is broader. It covers any information that identifies a person, and it requires you to notify your supervisory authority within 72 hours of becoming aware of a breach that risks people’s rights. Fines can reach €20 million or 4% of global annual turnover, whichever is higher. Small companies love to believe regulators only chase giants. My experience in European startup circles says otherwise: a complaint from one angry customer is enough to open a file.
Which patterns shape data breach news this month?
When you strip away the logos, almost every breach story in recent months fits one of seven patterns. Here is my November 2026 watchlist, ranked by how often I see founders get hurt by each one.
- Third-party and supplier breaches. Your data gets stolen from a vendor you trusted: a payroll tool, a file-transfer service, a marketing platform, a contractor. The 2023 MOVEit file-transfer attacks hit thousands of organizations through one piece of software. Verizon’s 2025 Data Breach Investigations Report found third-party involvement in breaches doubled to roughly 30%.
- Ransomware with data theft. Criminals no longer only encrypt files. They copy them first and threaten to publish. Verizon’s 2025 report found ransomware present in 44% of breaches overall and in a staggering 88% of breaches at small and medium-sized businesses.
- Stolen credentials and infostealer malware. One reused password, one browser that saved every login, one session cookie lifted by malware, and the attacker walks in through the front door. No “hacking” in the movie sense required.
- Shadow AI. Employees paste customer lists, contracts, and source code into AI chatbots the company never approved. IBM’s 2025 Cost of a Data Breach Report found that shadow AI added up to $670,000 to the average breach cost, and 97% of organizations that reported AI-related breaches lacked proper AI access controls.
- Misconfigured cloud storage. A public storage bucket, a test database without a password, a shared folder set to “anyone with the link.” These are leaks, and they get reported as breaches once someone downloads the data.
- Holiday-season phishing. Black Friday falls on November 27, 2026, and Cyber Monday on November 30. Fake shipping notices, fake supplier invoices, and fake “your payment failed” emails peak right now.
- Regulatory clocks. European rules keep tightening. NIS2 (the EU directive on network and information security) expanded the list of sectors with strict incident reporting. DORA (the Digital Operational Resilience Act) has applied to financial entities and their tech suppliers since January 17, 2025. The Cyber Resilience Act’s reporting obligations for manufacturers of products with digital elements started on September 11, 2026, which means this autumn is the first real test season.
Notice what is missing from this list: genius hackers breaking unbreakable encryption. The Wikipedia summary of technical root causes of data breaches lists insiders disclosing information, lost or stolen unencrypted devices, exploited software vulnerabilities, and social engineering such as phishing. Boring causes. Expensive outcomes.
Which breach statistics should scare small business owners?
I am allergic to fear-mongering stats with no source. So here are numbers from research you can verify, with my founder translation next to each one.
- $4.44 million: the global average cost of a data breach in IBM’s 2025 report, down from $4.88 million in 2024. Founder translation: the average fell, but for a company with €300,000 in the bank, any breach that costs even 5% of that average is a runway killer.
- $10.22 million: the average US breach cost in the same IBM report, a record high. Founder translation: if you sell to American customers, you inherit American legal costs.
- 88%: the share of small and medium business breaches involving ransomware in Verizon’s 2025 report. Founder translation: “we are too small” is the exact profile criminals prefer.
- ~60%: the share of breaches involving the human element (errors, phishing, misuse) in Verizon’s 2025 report. Founder translation: your biggest vulnerability eats lunch at your desk.
- $5.4 million: the average cost per US breach back in 2011, quoted in a Federal Trade Commission breach incident response guide by DLA Piper. Founder translation: fifteen years of security spending and the bill per breach has barely moved.
- 147 million: people affected by the 2017 Equifax breach, which started with an unpatched web application. Founder translation: one missed update can define a company forever.
- 3 billion: Yahoo accounts affected by the 2013 breach, disclosed years later. Founder translation: late disclosure turns a security problem into a trust and valuation problem.
Here is why these numbers matter more for you than for a corporation. A large company spreads breach costs across insurance, legal departments, and PR agencies. A startup absorbs them directly into its runway, its next funding round, and the founder’s sleep. I have watched investors walk away from deals during due diligence after discovering a past incident that nobody had reported properly. The breach itself was small. The silence around it was fatal.
Why do founders keep underestimating data breach risk?
I have three explanations, and none of them is flattering. First, founders confuse obscurity with safety. Most attacks are automated. Bots scan the internet for weak passwords, exposed databases, and outdated plugins without caring whether you are a bank or a two-person design studio. Your company name does not need to be famous to appear in a scan.
Second, founders think of “data” as customer data only. At CADChain, our entire business exists because engineers and manufacturers lose their most expensive asset, the intellectual property inside CAD files and 3D models, through careless sharing with suppliers and contractors. The Wikipedia definition notes that some researchers include intellectual property and classified information in breach definitions. I go further: for a hardware startup, a leaked design file can do more damage than a leaked email list, because a competitor in another jurisdiction can manufacture your product before you finish your seed round.
Third, founders treat security as a task for “later, when we hire a CTO.” My operating principle is that protection and compliance should be invisible. They need to live inside the tools and workflows your team already uses, so people do the right thing automatically. If your security plan depends on everyone remembering a policy document, you do not have a security plan. You have a wish.
“Women do not need more inspiration; they need infrastructure” is something I repeat constantly at Fe/male Switch, and the same logic applies to security for every founder. You do not need another scary keynote. You need a checklist, password manager seats, and a 24-hour response plan written before you need it.
What data do attackers actually want from a startup or freelancer?
The Fortinet glossary on how stolen data gets used explains that criminals use breached data to steal identities, take over social accounts, damage credit ratings, spend money on cards, and build new identities for future attacks. The IBM guide to breach objectives adds that a breach is often the first phase of a larger attack, such as using stolen executive email passwords to run business email compromise scams. For small companies, the most wanted items look like this:
- Founder and finance email accounts: perfect for fake invoice fraud and “urgent wire transfer” requests to your accountant.
- Customer databases: names, emails, addresses, purchase histories, sometimes payment details.
- API tokens and cloud credentials: often hard-coded in a public code repository by a tired developer at 2 a.m.
- Investor data rooms: cap tables, term sheets, and financial models attract competitors and extortionists alike.
- Design files, source code, and trade secrets: the IP that makes your startup worth funding.
- Payroll and HR files: bank details, ID scans, and contracts of your team members.
- Health and biometric data: if you run a health, fitness, or HR app, this is the most regulated data you will ever touch.
Take a freelance UX designer with ten clients. She stores client logins in a shared spreadsheet, keeps signed NDAs in her inbox, and reuses one password across her design tools. A single infostealer infection on her laptop exposes all ten clients at once. From a criminal’s point of view, she is a supply chain shortcut into ten companies. From a client’s point of view, she just became the reason they have to notify their customers.
How do you breach-proof a small company in 30 days?
No company can eliminate breach risk. Even Wikipedia’s summary says prevention efforts can reduce the risk but cannot remove it. What you can do is make yourself a harder, less profitable target than the company next door. Here is the plan I would give any founder, freelancer, or small business owner reading this in November 2026. It fits a team without a security department and mostly uses tools you already pay for.
Week 1: Lock the front doors
Week 2: Map your data
- List every place customer and company data lives: CRM, email marketing tool, accounting software, shared drives, AI tools, laptops, freelancers’ devices.
- Delete what you do not need. Data you never collected cannot leak. Old exports, abandoned test databases, and ex-employee folders are breach fuel.
- Check sharing settings on cloud folders and storage buckets. Anything set to “public” or “anyone with the link” gets reviewed today.
- Classify your crown jewels: the three to five data sets that would end your company if published. Those get the strictest access rules.
Week 3: Control people and suppliers
- Apply least privilege: each person gets access only to what their role needs. Your social media freelancer does not need access to your bank.
- Write an AI usage rule in one page: which AI tools are approved, and which data never goes into any chatbot (customer personal data, contracts, source code, unreleased designs).
- Ask your top five vendors how they notify customers of breaches and how fast. Put it in writing.
- Build a leaver checklist so departing team members and contractors lose access the same day.
Week 4: Prepare for the bad day
- Set up backups that ransomware cannot touch: at least one copy offline or immutable, and test a restore.
- Write a one-page incident response plan with names, phone numbers (not just emails, since email may be compromised), your lawyer, your insurer, and your data protection authority.
- Run a 30-minute tabletop game with your team: “Our CRM export appeared on a leak site. What do we do in the first hour?” I build games for a living, and nothing teaches faster than rehearsing a crisis with mild discomfort.
- Review cyber insurance and read the exclusions, especially around unpatched systems and missing MFA.
The FBI Internet Crime Complaint Center guidance on preparing for a data breach is worth bookmarking for US-based companies, and Australian founders can use the OAIC explanation of data breaches and individual harm to understand their obligations under Australian privacy law.
What should you do in the first 24 hours after a breach?
The FTC-hosted DLA Piper guide states that “the first 24 hours after you discover a breach are critical to restoring security, minimizing harm, obtaining and preserving evidence, and complying with contractual and legal obligations.” Here is the sequence I recommend for small teams:
- Contain without destroying evidence. Disconnect affected devices from the network. Do not wipe or reinstall them yet.
- Reset credentials for affected accounts and revoke active sessions and API tokens.
- Call your lawyer and insurer before you publish anything. Many insurance policies require early notice.
- Start a written timeline: when you noticed, what you saw, who did what. Regulators and courts will ask for it.
- Assess what data was involved and whose. That decides your notification duties under GDPR, US state laws, or other regimes.
- Prepare honest, plain-language communication for customers: what happened, what data, what you are doing, what they should do.
- Notify authorities on time. In the EU, the 72-hour GDPR clock starts when you become aware, which is earlier than most founders assume.
Which mistakes turn a small incident into a company-ending breach?
I have seen these mistakes in accelerator cohorts, in partner companies, and in my own early ventures. Avoid them and you are already ahead of most small businesses.
- Hiding the incident. Silence feels safe for a week, then it becomes a regulatory violation, a due diligence red flag, and a betrayal story on social media.
- Paying a ransom without advice. Payment does not guarantee deletion of stolen data, may break sanctions laws, and marks you as a payer for future attacks.
- Wiping infected machines immediately. You destroy the evidence you need to know what was taken.
- Sharing one admin account among the whole team, so nobody knows who did what.
- Keeping ex-contractor access alive for months after the project ended.
- Storing everything forever because “storage is cheap.” Breach costs are not.
- Trusting SMS-only two-factor codes for your most sensitive accounts, despite SIM-swap fraud.
- Letting the team use unapproved AI tools with customer data, then acting surprised when that data ends up somewhere you cannot control.
- Writing vague breach notices full of legal fog. Customers forgive mistakes faster than they forgive evasion.
- Assuming your vendor’s breach is not your problem. Under GDPR, you remain responsible for the personal data you entrusted to processors.
What are my contrarian takes on data breach news?
After years of building deeptech and edtech companies across Europe, here is where I disagree with the standard advice.
Take 1: Security awareness training mostly fails
Annual slide decks about phishing change almost nothing. My background in linguistics and learning design tells me people learn through consequence and practice, so I say it bluntly: education must be experiential and slightly uncomfortable. Run surprise simulated phishing emails, discuss the results openly without shaming anyone, and rehearse incident scenarios as a team game. Ten minutes of realistic practice beats two hours of compliance video.
Take 2: Your no-code stack is a security decision
I built Fe/male Switch with no-code tools, and I tell founders to default to no-code until they hit a hard wall. The flip side: every connected app, automation, and integration token is a door into your data. Keep an inventory of what talks to what. When a tool appears in the breach headlines, you need to know within minutes whether it touches your customers.
Take 3: Intellectual property theft is the silent breach
Personal data breaches make headlines because notification laws force disclosure. IP theft rarely does. Nobody sends you a letter saying your CAD file was copied by a supplier’s subcontractor. That is why at CADChain we embed traceability and access control directly inside the design tools engineers already use. If you are a hardware, design, or software founder, treat your IP like regulated data even though no law forces you to.
Take 4: AI makes small teams stronger and sloppier at the same time
I see AI as a force multiplier for solo founders and small teams, and I build AI agents for startup workflows myself. I also insist on human-in-the-loop AI: humans decide what data an AI touches. IBM’s finding that 97% of organizations with AI-related breaches lacked proper access controls tells you everything. The tool did not fail. The governance did, or rather, nobody bothered to set any rules.
What does breach-aware founding look like in real businesses?
Abstract advice is cheap. Here are three realistic scenarios showing how small changes cut breach exposure.
- The SaaS founder with five employees: she moves from shared admin logins to individual accounts with MFA, removes customer data from the staging environment, and sets alerts for unusual data exports. When a developer’s laptop gets infected with infostealer malware, the attacker finds no production credentials and no customer data in test systems. The incident stays an incident.
- The e-commerce shop before Black Friday: the owner updates all store plugins, removes an old payment module, and tells staff that refund or supplier bank-change requests always get confirmed by phone. A fake “supplier changed bank details” email arrives on November 26. Nobody pays it.
- The freelance consultant: he stops storing client credentials in notes apps, uses a password manager with separate vaults per client, and encrypts his laptop. When the laptop gets stolen from a train, he reports it, remotely wipes it, and his clients never need to notify anyone.
None of these scenarios required a security team, a big budget, or a CTO. They required a founder who decided that data protection belongs on the same list as cash flow and customer acquisition.
Frequently asked questions about data breach news
What is the difference between a data breach and a data leak?
The Washington State Attorney General glossary of data breach terms defines a data leak as sensitive data being accidentally or unintentionally exposed, while a breach involves data being accessed, disclosed, or used by an unauthorized person. A leak becomes a breach once someone unauthorized actually gets the data.
Do small businesses have to report data breaches?
Yes, in most cases. GDPR applies to companies of every size processing personal data of people in the EU, and every US state has its own notification law. Size does not exempt you. The type of data and the risk to people decide your duties.
How do I check if my data was exposed in a breach?
Watch for official notification letters, monitor your bank and card statements, and use reputable breach lookup services. The Malwarebytes guide to data breaches and digital footprint checks describes how individuals can see what information about them has been exposed.
Is a ransomware attack always a data breach?
IBM classifies ransomware that locks customer data and threatens to leak it as a data breach. Modern ransomware groups almost always steal data before encrypting it, so assume a breach until a forensic investigation proves otherwise.
Is a lost laptop a data breach?
It can be. Loss or theft of unencrypted devices is one of the classic root causes listed in breach research. Full-disk encryption often changes the legal assessment, because the data stays unreadable to the thief.
What should founders do before December?
Data breach news will keep arriving every week of November 2026 and every month after it. You cannot control which vendor gets hit next or which criminal group targets your sector. You can control how much damage reaches your company when it happens. I treat security the way I treat startup strategy: as a game where the goal is to collect protection, information, and allies faster than your opponents, while keeping enough runway to survive the bad turns.
Next steps for this week:
- Today: switch on MFA for your email, bank, and cloud storage.
- This week: buy password manager seats and kill the shared spreadsheet.
- Before Black Friday (November 27): brief your team on fake invoices and bank-change scams.
- Before December 1: write your one-page incident response plan with phone numbers, your lawyer, and your insurer.
- Before year-end: map your data, delete what you do not need, and set clear AI usage rules.
The companies in this month’s headlines did not plan to be there. Most of them had more money, more staff, and more tools than you. What separates the founders who survive a breach from those who disappear is preparation done on a calm Tuesday, long before the crisis. Do the boring work now, and make sure the next breach story you read is about someone else.
People Also Ask:
What are the 7 types of cyber security?
The seven types most often listed are network security, application security, information (data) security, cloud security, endpoint security, mobile and IoT security, and operational security. Network security guards traffic and connections. Application security protects software from flaws. Information security keeps stored and transmitted data private. Cloud security covers hosted services. Endpoint security protects laptops and phones. Mobile and IoT security covers connected devices. Operational security governs how data is handled and who can access it. Some lists include identity and access management or disaster recovery instead, so the exact seven differ by source.
What is another word for data breach?
Common alternatives include data leak, security breach, data spill, information leakage, data compromise, and unauthorized disclosure. Some people also say "cyber incident," but that term is broader and can cover attacks where no data is exposed. "Data leak" is the closest match and is often used interchangeably, though it sometimes describes accidental exposure rather than a deliberate attack.
What is a breach example?
A well-known case is the 2017 Equifax breach. Attackers exploited an unpatched web application flaw and accessed the personal records of roughly 147 million people, including names, Social Security numbers, and birth dates. Smaller breaches happen every day too. An employee emailing a spreadsheet of customer details to the wrong person, a lost unencrypted laptop, or a misconfigured cloud database left open to the public internet all count as data breaches.
What does the word "breach" mean?
"Breach" means a break, gap, or violation. It can describe a physical opening, such as a breach in a wall or dam. It can also mean a failure to honor a rule or promise, as in a breach of contract or a breach of trust. In cybersecurity, it refers to someone breaking through security controls to reach information they are not authorized to see.
What are the most common causes of a data breach?
Most breaches trace back to four causes:
- Cyberattacks: Hacking, malware, ransomware, SQL injection, and credential stuffing.
- Human error: Misconfigured cloud storage, emails sent to the wrong recipient, and lost devices.
- Social engineering: Phishing scams that trick people into handing over login details.
- Insider threats: Current or former employees with system access who leak data on purpose or through carelessness.
What types of data are exposed in a data breach?
Breaches can expose many kinds of information, including:
- Personally Identifiable Information (PII): Full names, Social Security numbers, and ID card numbers.
- Financial information: Credit card numbers, bank account details, and payment credentials.
- Health records: Patient files and protected health information (PHI).
- Corporate secrets: Intellectual property, source code, and internal plans.
- Login credentials: Email addresses, usernames, and passwords.
What is the difference between a data breach and a data leak?
A data breach usually involves an intentional act, where an attacker or insider breaks through defenses to access or steal information. A data leak typically happens by accident, when data is exposed through a mistake such as a public storage bucket or a misdirected email, with no break-in required. In both cases, sensitive information reaches people who should not have it. Many sources treat the two terms as interchangeable.
What happens to a company after a data breach?
Companies face financial losses that often reach millions of dollars, covering investigation, legal fees, customer notification, and system repairs. They may also receive fines from regulators, face class-action lawsuits, and suffer lasting reputational damage that pushes customers away.
Reporting deadlines are strict. Under the EU's GDPR, a personal data breach must be reported to authorities within 72 hours of discovery. The SEC requires U.S. public companies to disclose material cybersecurity incidents within four business days of determining they are material.
What should I do if my data was exposed in a data breach?
Start with these steps:
- Change the password on the affected account and on any other account that uses the same password.
- Turn on two-factor authentication.
- Check whether your email appears in known breaches with a free service such as Have I Been Pwned.
- Watch your bank and credit card statements for unfamiliar charges.
- Consider freezing your credit if financial or Social Security data was involved.
- Be wary of phishing emails that mention the breach, since scammers often follow up on leaked data.
How can data breaches be prevented?
Organizations and individuals can lower their risk with layered defenses:
- Strong, unique passwords and multi-factor authentication.
- Prompt software patching.
- Encryption of stored and transmitted data.
- Limited access, so people only see the data their role requires.
- Regular staff training to help people spot phishing attempts.
- Security audits and monitoring to catch misconfigurations and suspicious activity early.
- Removing access for former employees right away.
FAQ on Data Breach News and Small Business Protection in 2026
Will the EU Digital Omnibus extend the GDPR data breach reporting deadline?
Possibly. On 21 October 2026, the EU Council backed giving businesses more time to report breaches and creating national single entry points for incident reports. The European Parliament has not voted yet, so keep working to the 72-hour rule until the final text is adopted. Read the Digital Omnibus GDPR breach deadline analysis
How quickly must my SaaS vendor tell me about a data breach?
Under GDPR Article 33(2), processors must alert customers without undue delay. You then have 72 hours to notify your authority. Entities covered by NIS2 also owe a 24-hour early warning. Write specific notification hours into vendor contracts and demand written lists of affected records. See the eSignFlow vendor breach timeline explained
Why are forgotten test accounts such a common breach entry point?
Nobody monitors them. Ogi Networks' "Test2" account, protected by "Password1," stayed active for over 12 years before ransomware attackers used it, exposing about 3,300 people. Export every user account quarterly, delete test logins, block common passwords, and give each admin a named login. Run the Password1 account audit for founders
How long can hackers hide inside a network before anyone notices?
Sometimes almost a year. Attackers in TriZetto's systems went undetected that long and were still active in October 2025, exposing over 3.4 million people's health data. Shorten dwell time with zero-trust access, alerts on unusual logins and bulk exports, and regular log reviews by a named owner. Study the TriZetto breach detection failure
Is pseudonymized data safe if my analytics provider gets breached?
Not always. Pseudonymized identifiers can be re-identified when combined with emails, locations, or behaviour logs, a risk the 2025 Mixpanel breach brought into focus. Send analytics tools only the fields you need, prefer client-side encryption, and check vendor contracts for breach transparency duties. Review the Mixpanel analytics breach lessons
What is data exfiltration and how can a small team spot it?
Exfiltration is the unauthorized transfer of data out of your systems, usually over the internet or by email. Warning signs include large outbound transfers, new forwarding rules in mailboxes, and logins from unfamiliar countries. Enable export alerts in your CRM and cloud storage. Read the Washington Attorney General data breach glossary
Should a US business report a data breach to the FBI?
Yes, if criminals were involved. File a complaint with the FBI's Internet Crime Complaint Center, especially after ransomware, extortion, or business email compromise. Reports help track criminal groups and can support recovery of wired funds when filed quickly. Notifying state attorneys general is a separate duty. File through the FBI IC3 data breach page
Does an employee misusing legitimate access count as a data breach?
It can. Proofpoint calls this insider misuse, meaning authorized staff use their access inappropriately, such as exporting client lists before joining a competitor. If personal data leaves your control, notification rules may apply. Log who downloads what, restrict bulk exports, and revoke access before announcing departures. Explore Proofpoint's insider misuse explanation
How do regulators judge whether a breach causes serious harm?
They look at consequences for people, not just record counts. Australia's OAIC recognises distress and financial loss as harm. Assess how sensitive the data is, whether it was encrypted, who obtained it, and whether you can still prevent misuse. Document that reasoning, because it justifies your decision to notify or not. See how the OAIC defines data breach harm
How can European founders turn breach readiness into a growth advantage?
Treat GDPR, NIS2, and DORA readiness as a sales asset, because enterprise buyers and investors now send security questionnaires. Keep a data map, processor contracts, and an incident plan in your data room. Security evidence speeds up procurement and due diligence. Explore the European Startup Playbook
