How much should an organisation reveal about a data breach? (www.arrl.org)

submitted 5 months ago by vk6flab@lemmy.radio to c/privacy@lemmy.ml

13 comments fedilink hide all child comments

There is a growing trend where organisations are strictly limiting the amount of information that they disclose in relation to a data breach. Linked is an ongoing example of such a drip feed of PR friendly motherhood statements.

As an ICT professional with 40 years experience, I'm aware that there's a massive gap between disclosing how something was compromised, versus what data was exfiltrated.

For example, the fact that the linked organisation disclosed that their VoIP phone system was affected points to a significant breach, but there is no disclosure in relation to what personal information was affected.

For example, that particular organisation also has the global headquarters of a different organisation in their building, and has, at least in the past, had common office bearers. Was any data in that organisation affected?

My question is this:

What should be disclosed and what might come as a post mortem after systems have been secured restored?

top 13 comments

sorted by: hot top controversial new old

[-] tsonfeir@lemmy.world 13 points 5 months ago

Every little detail. Including access to the raw data that was leaked (that pertains to the individual). The steps taken to correct the action if possible. The source of the attack, including raw access logs if possible.

Basically, let me decide how fucked I am, how it happened, and who now has my data.

[-] delirious_owl@discuss.online 9 points 5 months ago* (last edited 5 months ago)

Please no. I don't want a copy my passport image included in the announcement about the data leak. Its extremely hard to change my passport, and its better if its not on the official announcement, even if it is being traded on the darknet.

They should say what data fields were leaked, but not re-leak the actual raw data to the world on the clearnet.

[-] tsonfeir@lemmy.world 3 points 5 months ago

I didn’t mean they would publish the information to the internet in an insecure way. But I should, if i CHOOSE, get a copy of the leaked data. You don’t have to ask for it.

[-] delirious_owl@discuss.online 2 points 5 months ago

So you get kyc data on all their other customers? That's literally a criminal offence in some countries.

[-] a4ng3l@lemmy.world 4 points 5 months ago

Nha they publish metadata describing the leaked data. If you’re a data subject concerned by the incident you then request a copy of yr information which requires proper identification.

Why would they share the data itself….

[-] delirious_owl@discuss.online 0 points 5 months ago

Why does wikileaks share the data itself? People do these things..

[-] a4ng3l@lemmy.world 7 points 5 months ago

They are active in whistleblowing, not privacy leak management…

[-] sic_semper_tyrannis@lemmy.today 5 points 5 months ago

Everything. Data breaches/leaks happen all the time. The more these companies have to admit what happened and be shamed and fined the more they will care about security for their customers.

[-] delirious_owl@discuss.online 0 points 5 months ago* (last edited 5 months ago)

Please don't reveal my email address in your data breach announcement, sheesh.

[-] thedirtyknapkin@lemmy.world 4 points 5 months ago

i mean, i don't think anyone has actually considered including the leaked data in the leak announcement. it seems so obvious to just say which fields are leaked that i hadn't even considered that someone might think to include the data itself.

[-] delirious_owl@discuss.online 3 points 5 months ago* (last edited 5 months ago)

I responded to a comment that said everything. Everything means everything. We should qualify that it shouldn't be everything.

There's literally someone in another comment on this thread saying that they should be able to get the raw data that was leaked from the company on request.

[-] drwho@beehaw.org 5 points 5 months ago

Companies are trying to go back to the time when they got popped and told nobody.

[-] Clbull@lemmy.world 2 points 5 months ago

Date that the breach occurred.
What parts of the system were accessed.
What data was compromised and if any of it is sensitive.
If any of this data was encrypted/hashed and what algorithm was used (i.e. I'd be far less worried about having passwords that are bcrypt hashed exposed compared to ones hashed with SHA1 or stored in plain text.)

this post was submitted on 10 Jun 2024

36 points (97.4% liked)

Privacy

32024 readers

1132 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

Chat rooms

[Matrix/Element]Dead
Discord

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS