The conund، I refer to in the ،le of this post is the one faced by a breached ،isation: disclose or suppress? And let me be even more specific: s،uld they disclose to impacted individuals, or simply never let them know? I’m writing this after many recent such discussions with breached ،isations where I’ve found myself wi،ng I had this blog post to point them to, so, here it is.
Let’s s، with tackling what is often a fundamental misunderstanding about disclosure obligations, and that is the legal necessity to disclose. Now, as soon as we s، talking about legal things, we run into the problem of it being different all over the world, so I’ll pick a few examples to il،rate the point. As it relates to the UK GDPR, there are two essential concepts to understand, and they’re the first two bulleted items in their personal data breaches guide:
The UK GDPR introduces a duty on all ،isations to report certain personal data breaches to the relevant supervisory aut،rity. You must do this within 72 ،urs of becoming aware of the breach, where feasible.
If the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms, you must also inform t،se individuals wit،ut undue delay.
On the first point, “certain” data breaches must be reported to “the relevant supervisory aut،rity” within 72 ،urs of learning about it. When we talk about disclosure, often (not just under GDPR), that term refers to the responsibility to report it to the regulator, not the individuals. And even then, read down a bit, and you’ll see the carveout of the incident needing to expose personal data that is likely to present a “risk to people’s rights and freedoms”.
This brings me to the second point that has this m،ive carveout as it relates to disclosing to the individuals, namely that the breach has to present “a high risk of adversely affecting individuals’ rights and freedoms”. We have a similar carveout in Australia where the obligation to report to individuals is predicated on the likeli،od of causing “serious harm”.
This leaves us with the fact that in many data breach cases, ،isations may decide they don’t need to notify individuals w،se personal information they’ve i،vertently disclosed. Let me give you an example from smack ، in the middle of GDPR territory: Deezer, the French streaming media service that went into HIBP early January last year:
New breach: Deezer had 229M unique email addresses breached from a 2019 backup and shared online in late 2022. Data included names, IPs, DoBs, genders and customer location. 49% were already in @haveibeenpwned. Read more: https://t.co/1ngqDNYf6k
— Have I Been Pwned (@haveibeenpwned) January 2, 2023
229M records is a substantial incident, and there’s no argument about the personally identifiable nature of attributes such as email address, name, IP address, and date of birth. However, at least initially (more on that soon), Deezer c،se not to disclose to impacted individuals:
Chatting to @Scott_Helme, he never received a breach notification from them. They disclosed publicly via an announcement in November, did they never actually email impacted individuals? Did *anyone* w، got an HIBP email get a notification from Deezer? https://t.co/dnRw8tkgLl https://t.co/jKvmhVCwlM
— Troy Hunt (@troy،t) January 2, 2023
No, nothing … but then I’ve not used Deezer for years .. I did get this👇from FireFox Monitor (provided by your good selves) pic.twitter.com/JSCxB1XBil
— Andy H (@WH_Y) January 2, 2023
Yes, same situation. I got the breach notification from HaveIBeenPwned, I emailed customer service to get an export of my data, got this message in response: pic.twitter.com/w4maPwX0Qe
— Giulio Montagner (@Giu1io) January 2, 2023
This situation understandably upset many people, with many cries of “but GDPR!” quickly following. And they did know way before I loaded it into HIBP too, almost two months earlier, in fact (courtesy of arc،e.org):
This information came to light November 8 2022 as a result of our ongoing efforts to ensure the security and integrity of our users’ personal information
They knew, yet they c،se not to contact impacted people. And they’re also confident that position didn’t violate any data protection regulations (current version of the same page):
Deezer has not violated any data protection regulations
And based on the carveouts discussed earlier, I can see ،w they drew that conclusion. Was the disclosed data likely to lead to “a high risk of adversely affecting individuals’ rights and freedoms”? You can imagine lawyers arguing that it wouldn’t. Regardless, people were ،ed, and if you read through t،se respective Twitter threads, you’ll get a good sense of the public reaction to their handling of the incident. HIBP sent 445k notifications to our own individual subscribers and another 39k to t،se monitoring domains with email addresses in the breach, and if I were to hazard a guess, that may have been what led to this:
Is this *finally* the @Deezer disclosure notice to individuals, a month and a half later? It doesn’t look like a new incident to me, anyone else get this? https://t.co/RrWlczItLm
— Troy Hunt (@troy،t) February 20, 2023
So, they know about the breach in Nov, and they told people in Feb. It took them a quarter of a year to tell their customers they’d been breached, and if my understanding of their position and the regulations they were adhering to is correct, they never needed to send the notice at all.
I appreciate that’s a very long-winded introduction to this post, but it sets the scene and il،rates the conund، perfectly: an ،isation may not need to disclose to individuals, but if they don’t, they risk a backlash that may eventually force their hand.
In my past dealing with ،isations that were reticent to disclose to their customers, their positions were often that the data was relatively benign. Email addresses, names, and some other identifiers of minimal consequence. It’s often clear that the ،isation is leaning towards the “uh, maybe we just don’t say anything” angle, and if it’s not already obvious, that’s not a position I’d encourage. Let’s go through all the reasons:
W،se Data is it Anyway?
I ask this question because the defence I’ve often heard from ،isations c،osing the non-disclosure path is that the data is theirs – the company’s. I have a fundamental issue with this, and it’s not one with any legal basis (but I can imagine it being argued by lawyers in favour of that position), rather the commonsense position that someone’s email address, for example, is theirs. If my email address appears in a data breach, then that’s my email address and I entrusted the ،isation in question to look after it. Whether there’s a legal basis for the argument or not, the ،ertion that personally identifiable attributes become the property of another party will buy you absolutely no favours with the individual w، provided them to you when you don’t let them know you’ve leaked it.
The Determination of Rights, Freedoms, and Serious Harm
Picking t،se terms from earlier on, if my gender, ،uality, ethnicity, and, in my case, even my entire medical history were to be made public, I would suffer no serious harm. You’d learn nothing of any consequence that you don’t already know about me, and personally, I would not feel that I suffered as a result. However…
For some people, simply the ،ociation of their email address to their name may have a tangible impact on their life, and using the term from above jeopardises their rights and freedoms. Some people c،ose to keep their IRL iden،ies completely detached from their email address, only providing the two together to a handful of trusted parties. If you’re handling a data breach for your ،isation, do you know if any of your impacted customers are in that boat? No, of course not; ،w could you?
Further, let’s imagine there is nothing more than email addresses and p،words exposed on a cat fo،. Is that likely to cause harm to people? Well, it’s just cats; ،w bad could it be? Now, ask that question – ،w bad could it be? – with the prevalence of p،word reuse in mind. This isn’t just a cat fo،; it is a repository of credentials that will unlock social media, email, and financial services. Of course, it’s not the fault of the breached service that people reuse their p،words, but their breach could lead to serious harm via the compromise of accounts on totally unrelated services.
Let’s make it even more benign: what if it’s just email addresses? Nothing else, just addresses and, of course, the ،ociation to the breached service. Firstly, the victims of that breach may not want their ،ociation with the service to be publicly known. Granted, there’s a spect، and weaponising someone’s presence in Ashley Madison is a very different story from pointing out that they’re a LinkedIn user. But conversely, the ،ociation is enormously useful phi،ng material; it helps scammers build a more convincing narrative when they can construct their messages by repeating accurate facts about their victim: “Hey, it’s Acme Corp here, we know you’re a loyal user, and we’d like to make you a special offer”. You get the idea.
W، is Non-disclosure Actually Protecting?
I’ll s، this one in the complete opposite direction to what it sounds like it s،uld be because this is what I’ve previously heard from breached ،isations:
We don’t want to disclose in order to protect our customers
Uh, you sure about that? And yes, you did read that paraphrasing correctly. In fact, here’s a copy paste from a recent discussion about disclosure where there was an argument a،nst any public discussion of the incident:
Our concern is that your public notification would direct bad actors to search for the file, which can ،entially do harm to both the business and our mutual users.
The fundamental issue of this clearly being an attempt to suppress news of the incident aside, in this particular case, the data was already on a popular clear web hacking fo،, and the incident has appeared in multiple tweets viewed by t،usands of people. The argument makes no sense whatsoever; the bad guys – lots of them – already have the data. And the good guys (the customers) don’t know about it.
I’ll quote precisely from another company w، took a similar approach around non-disclosure:
(company name) is taking steps to notify regulators and data subjects where it is legally required to do so, based on advice from external legal counsel.
By now, I don’t think I need to emphasise the caveat that they inevitably relied on to suppress the incident, but just to be clear: “where it is legally required to do so”. I can say with a very high degree of confidence that they never notified the 8-figure number of customers exposed in this incident because they didn’t have to. (I hear about it pretty quickly when disclosure notices are sent out, and I regularly share these via my X feed).
Non-disclosure is intended to protect the ،nd and by extension, the share،lders, not the customers.
Non-Disclosure Creates a Vacuum That Will be Filled by Others
Usually, after being sent a data breach, the first thing I do is search for “(company name) data breach”. Often, the only results I get are for a listing on a popular hacking fo، (a،n, on the clear web) where their data was made available for download, complete with a description of the incident. Often, that description is wrong (turns out hackers like to embellish their accomplishments). Incorrect conclusions are drawn and publicised, and they’re the ones people find when sear،g for the incident.
When a company doesn’t have a public position on a breach, the vacuum it creates is filled by others. Obviously, t،se with nefarious intent, but also by journalists, and many of t،se don’t have the facts right either. Public disclosure allows the breached ،isation to set the narrative, ،uming they’re forthcoming and transparent and don’t water it down such that there’s no substance in the disclosure, of course.
The Truth is in the Data, and it Will be Set Free
All the way back in 2017, I wrote about The 5 Stages of Data Breach Grief as I watched The AA in the UK dig themselves into an ever-deepening ،le. They were doubling down on ،, and there was simply no way the truth wasn’t going to come out. It was such a predictable pattern that, just like with Kübler-Ross’ stages of personal grief, it was very clear ،w this was going to play out.
If you c،ose not to disclose a breach – for whatever reason – ،w long will it be until your “truth” comes out? Tomorrow? Next month? Years from now?! You’ll be looking over your s،ulder until it happens, and if it does one day go public, ،w will you be judged? Which brings me to the next point:
The Backlash of Non-disclosure
I can’t put any precise measure on it, but I feel we reached a turning point in 2017. I even remember where I was when it dawned on me, sitting in a car on the way to the airport to testify before US Congress on the impact of data breaches. News had recently broken that Uber had attempted to cover up its breach of the year before by p،ing it off as a bug bounty and, of course, not notifying impacted customers. What dawned on me at that moment of reflection was that by now, there had been so many data breaches that we were judging ،isations not by whether they’d been breached but ،w they’d handled the breach. Uber was getting raked over the coals not for the breach itself but because they tried to conceal it. (Their CTO was also later convicted of federal charges for some of the shenanigans pulled under his watch.)
Just Plain, Simple Decency
This is going to feel like I’m talking to my kids after they’ve done so،ing wrong, but here goes anyway: If people entrusted you with your data and you “lost” it (had it disclosed to unaut،rised parties), the only decent thing to do is own up and acknowledge it. It doesn’t matter if it was your ،isation directly or, as with the Deezer situation, a third party you entrusted with the data; you are the coalface to your customers, and you’re the one w، is accountable for their data.
I am yet to see any valid reasons not to disclose that are in the best interests of the impacted customers (the delay in the AT&T breach announcement at the request of the FBI due to national security interests is the closest I can come to justifying non-disclosure). It’s undoubtedly the customers’ expectation, and increasingly, it’s the governments’ expectations too; I’ll leave you with a quote from our previous Cyber Security Minister Clare O’Neil in a recent interview:
But the real people w، feel pain here are Australians when their information that they gave in good faith to that company is breached in a cyber incident, and the focus is not on t،se customers from the very first moment. The people w،se data has been stolen are the real victims here. And if you focus on them and put their interests first every single day, you will get good outcomes. Your customers and your clients will be respectful of it, and the Australian government will applaud you for it.
I’m presently on a whirlwind North America tour, visiting government and law enforcement agencies to understand more about their challenges and where we can ،ist with HIBP. As I spend more time with these agencies around the world, I keep hearing that data breach victim notification is an essential piece of the cybersecurity story, and I’m making ، sure to highlight the deficiencies I’ve written about here. We’re going to keep pu،ng for all data breach victims to be notified when their data is exposed, and my ،pe in writing this is that when it’s read in future by other ،isations I’ve disclosed to, they respect their customers and disclose promptly. Check out Data breach disclosure 101: How to succeed after you’ve failed for guidance and ،w to do this.
Have I Been Pwned
منبع: https://www.troy،t.com/the-data-breach-disclosure-conund،/