How to Prevent The Data Breach That Keeps On Happening

The potential for revealing personally identifiable information (PII) in the ‘To’ or ‘CC’ fields of an email is a risk well understood. Yet despite this, it remains the source of far too many data breaches.

• In January 2020, Capita accidentally leaked the email addresses of all those attached to a support incident ticket on their call handling system.
• In October 2019, West Berkshire Council sent an email containing a survey about leisure centres to 1,107 recipients who could all see each other's email addresses.
• In April 2019, the UK Home Office accidentally disclosed details of hundreds of EU citizens requesting settled status to one another
• A UK Freedom of Information request in 2018, showed at least 147 self-reported data breaches to the ICO were down to this error.

Accidental in nature, it’s easy to see why these types of breaches occur. When we want to send an email to a number of people – be that a newsletter, an event invitation, or an update on a technical support ticket – we might simply copy and paste the email addresses into the ‘To’ or ‘CC’ fields and press ‘Send’ without giving it a second thought. This approach means that all recipients of the email are visible to each other, which isn’t a problem if you are addressing a group known to one another, but in the case of a mailing list to customers, it is a privacy breach that could result in a fine.

It is no surprise that human error is the cause of so many breaches. Conditioned to using email, we have become inured to the potential danger that exists every time we press ‘Send’. Focusing on the task at hand, we don’t always give the time required to consider the privacy ramifications of our actions. We know that ‘BCC’, or blind carbon copy, is the field to use to ensure email addresses remain private, yet accidents still happen. What can an organization do to mitigate this risk?

Reducing the risk of an email data breach

To offset the inevitable risk associated with email communications, organizations need a clear cybersecurity strategy encompassing people, processes, and technology. Email policies need to be established, the workforce trained, and policy rules enforced with software. The software acts as the final safety net against the inadvertent actions of employees.

The Clearswift Secure Email Gateway can support employees to make better decisions, without increasing the administration burden on the IT support team.

In the gateway, simply create an email policy rule that automatically holds emails where the number of recipients in the “To” or “CC” fields exceeds a minimum number set. When an email exceeds that threshold, an alert is sent to the employee. If the action was deliberate, the employee can release the email without the need to raise an IT support ticket. The decision to release the email message is audited and recorded in the gateway. If, however, a mistake occurred, the employee can delete the email and create a new version compatible with the organization’s privacy policies.