Data Breach Response Guide

By Experian

Data Breach Resolution

Data Breach

Response Guide

2020-2021 Edition









































































































Michael Bruemmer





Foreword

The COVID-19 outbreak has upended business and life as usual. Consumers habits and attitudes

toward shopping and working online are changing, and companies’ work-from-home policies may

never be the same.

Perhaps it’s no surprise that cybercrime may look a little dierent as well.

Identity Theft Resource Center. 2020. Q3 Data Breach Analysis and Key Takeaways

RiskBased Security. 2020. Mid Year Data Breach QuickView Report

INTERPOL. 2020, April 4. Cybercriminals targeting critical healthcare institutions with ransomware

Forbes. 2020, March 21. FBI Coronavirus Warning: ‘Signicant Spike’ In COVID-19 Scams Targeting These Three States

Experian and Ponemon. 2020. Seventh Annual Study: Is Your Company Ready for a Big Data Breach?

IBM and Ponemon. 2020. Cost of a Data Breach Report

Practicing Your Plan 20

Conduct Response Exercises Routinely 20

Implementing a Drill Exercise 21

Developing Your Drill 22

Developing Injects 22

Quiz: How Prepared Are You 23

Responding to a Data Breach 24

The First 24-hours 24

Next Steps 25

Managing Communications and

Protecting Your Reputation 26

Protecting Legal Privilege 27

Taking Care of Your Consumers 28

Auditing Your Plan 30

How the Pandemic Impacts Your Response Plan 31

Areas to Focus On 31

Preparedness Audit Checklist 32

Experian® Reserved Response™ 33

A Proactive Approach 31

Guaranteed and Scalable 31

Helpful Resources 34

Foreword 2

Introduction 4

Industry Perspective 6

Financial Services 6

Healthcare 7

Small and Medium-Sized Businesses 7

Keeping Pace with Cybercriminals 8

Engaging the C-Suite 10

Why do Consumer Response Plans Fail? 11

Lack of Preparedness and Planning 11

Creating Your Plan 12

Start With a Bullet-Proof Response Team 12

Engage Your External Partners 14

Understand the Impact of Inuencers 15

What to Look for in a Breach Response Partner 15

Additional Considerations 16

Selecting Legal Partners 16

Selecting a Breach Response Provider 17

Incorporating Crisis Communications 17

Managing International Breaches 18

Table of Contents

Experian Information Solutions, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners.

Legal Notice: The information you obtain herein is not, nor intended to be, legal advice. We try to provide quality information but make no claims, promises

or guarantees about the accuracy, completeness or adequacy of the information contained. As legal advice must be tailored to the specic circumstances

of each case and laws are constantly changing, nothing provided herein should be used as a substitute for the advice of competent legal counsel.



felt far beyond the walls of the tech and security teams.



















































































Introduction

PwC. 2020. Digital Trust Insights Pulse Survey

RiskBased Security. 2020. Mid Year Data Breach QuickView Report

IBM and Ponemon. 2020. Cost of a Data Breach Report

Experian. 2019. Data Breach Consumer Survey

Since the pandemic, 95% of CISOs plan to integrate

cyber risks with overall enterprise risk management.

95%

Report Date: 1/8/2020

Identity Theft Resource Center: 2019 

Total Breaches: 1,473 | Records Exposed: 164,683,455

Breaches Identied by the ITRC as of: 1/8/2020

Industry

# of

Breaches

% of

Breaches

# of Sensitive

Records

Expose

% of

Sensitive

Records

# of

Non-Sensitive

Records Exposed

% of

Non-Sensitive

Records Exposed

Banking/Credit/Financial 108 7.33% 100,621,770 61.10% 20,000 0.003%

Educational 113 7.67% 2,252,439 1.37% 23,103 0.003%

Medical/Healthcare 525 35.64% 39,378,157 23.91% 1,852 0.000%

Business 644 43.72% 18,824,975 11.4 3% 705,106,352 99.990%

Government/Military 83 5.63% 3,606,114 2.19% 22,747 0.003%

Totals for All Categories: 1,473 100.0% 164,683,455 100.0% 705,174,054 100.0%

Introduction



















immediately















IBM and Ponemon. 2020. Cost of a Data Breach Report

Identity Theft Resource Center. 2020. 2019 End-of-Year Data Breach Report

In 2019, data breaches cost

companies an average of $1.52

million in lost business.

$1.52M

Financial Services

















































VMWare Carbon Black. 2020. Modern Bank Heists 3.0

Identity Theft Resource Center. 2020. 2019 End of Year Data Breach Report

IBM and Ponemon. 2020. Cost of a Data Breach Report

Industry

Perspective

Healthcare































































Small and Medium-Sized Businesses

































































Identity Theft Resource Center. 2020. 2019 End-of-Year Data Breach Report

INTERPOL. 2020, April 4. Cybercriminals targeting critical healthcare institutions with ransomware

Microsoft. 2020. Digital Defense Report

IBM and Ponemon. 2020. Cost of a Data Breach Report

Keeper Security and Ponemon. 2019. Global State of Cybersecurity in Small and Medium-Sized Businesses

Industry Perspective

Keeping Pace

with Cybercriminals

The world of cybersecurity is ever-changing.















Taking Advantage of Changes in Business Operations





















































BakerHostetler. 2020. Data Security Incident Response Report

Verizon. 2020. Data Breach Investigations Report

PwC. 2020. Digital Trust Insights Pulse Survey

KIVU. 2020. Threat Intelligence Reports March 2020

Ransomware











Tactics and Techniques

































































































Malwarebytes.2020. Enduring from home COVID-19’s impact on business security

Microsoft. 2020. Digital Defense Report

Experian and Ponemon. 2020. Seventh Annual Study: Is Your Compnay Ready for a Big Data Breach?

Keeping Pace with Cybercriminals

of employees admit to using

personal devices for work-

related activity more than

their work-issued devices.

28%

Engaging

the C-Suite

The involvement of the executive

team greatly determines the success

of a data breach response plan.































When working to gain the support of your company’s leadership, consider these 2019 data points:

Engagement







63%







$8.64 million:



$3.86 million:





80%





$302,539:





$146:





207 days:







$2 million:







Experian and Ponemon. 2020. Seventh Annual Study: Is Your Company Ready for a Big Data Breach?

IBM and Ponemon. 2020. Cost of a Data Breach Report

BakerHostetler. 2020. Data Security Incident Response Report

Why do Consumer

Response Plans Fail?

Lack of preparedness and planning

Annual budget for guaranteed customer response

resources and maintaining customer response

readiness is $0













• 



• 





• 







There is no estimate for the number of customer

calls, emails, or messages expected





















The notication plan has never been tested

by a live drill















The maximum number of customers that could be

breached is unknown













The availability of the sta expected to service those

queries is not guaranteed













Speed is critical – 72-hour notication regulations

with massive nes













Start with a bullet-proof response team.











• 

• 





• 





• 

processes and procedures

• 



• 



• 



• 

• 

• 

• 

• 

INCIDENT LEAD CUSTOMER CARE

Creating

Your Plan

Preparation





• 



• 



• 



• 





• 



evidence and progress

• 







Respond and Recover

• 



• 



• 



• 



• 



C-SUITE

INFORMATION TECHNOLOGY

PUBLIC RELATIONS AND/OR

CORPORATE COMMUNICATIONS

Creating Your Plan

Engage your external partners:

CRISIS

COMMUNICATIONS

DATA BREACH

RESOLUTION PROVIDER

FORENSICS

LEGAL COUNSEL











• 

during an incident

• 



• 







• 







• 



• 







• 











• 



• 















• 





• 







Creating Your Plan





1. Understanding of Security and Privacy









2. Strategic Insights – Can They Answer and Handle

“What If” Scenarios?









3. Relationship with Regulators











4. Ability to Scale









5. Global Considerations













What to Look for in a Breach Response Partner

Creating Your Plan

of data breach response

plans include procedures for

communicating with state attorneys

general and regulators. However,

only 14% of organizations have met

with law enforcement and/or state

regulators in preparation.

71%

Experian and Ponemon. 2020. Seventh Annual Study: Is Your Company Ready for a Big Data Breach?

State Attorneys General and Regulators



















Law Enforcement

















• 









• 















• 























Additional Considerations

• 











• 











• 







Despite the substantial nancial risk

organizations face when it comes to

data breaches, only half of companies

have cyber insurance to help cover

them when an incident occurs.







Selecting Legal Partners

Creating Your Plan

Experian and Ponemon. 2020. Seventh Annual Study: Is Your Company Ready for a Big Data Breach?



















Selecting a Breach Response Provider Incorporating Crisis Communications

• 





• 



• 





responses

• 









• 



• 





• Enlist a Representative:







• Map Out Your Process:







• Cover All Audiences:





• Prepare Templated Materials:



• 

• 



• 

• 

• Test Your Communications Process:









Creating Your Plan

Experian and Ponemon. 2020. Seventh Annual Study: Is Your Company Ready for a Big Data Breach?

of incident response

plans include processes

for managing international

data breaches.

64%





















































Managing International Breaches

Creating Your Plan

Coordinate a multinational response team:













Prepare for increased stakeholder engagement:























Your organization can take the following steps to better

prepare for an international data breach.

Organize consumer notication and support:



























Preparing for an international data breach

1. 

2. 

3. 

Creating Your Plan

Practicing

Your Plan

Conduct Response Exercises Routinely











Practicing Response Plan









Responsibilities of Your Team







• 



• 



• 



• 

ACTIVITIES SHOULD INCLUDE:

• 



• 





• 





Experian and Ponemon. 2020. Seventh Annual Study: Is Your Company Ready for a Big Data Breach?

Implementing a Drill Exercise







Practicing Your Plan

VERIFY YOUR ORGANIZATION IS READY TO CARRY OUT YOUR RESPONSE PLAN BY DOING THE FOLLOWING:

• 





• 

• 

• 

• 

• 

• 

• 

• 







WHO TO INVOLVE:

Complete materials and workows





Enlist an outside facilitator





Schedule a healthy amount of time







Include everyone







Test multiple scenarios







Debrief after the exercise





Conduct drills every 6 months





Experian and Ponemon. 2020. Seventh Annual Study: Is Your Company Ready for a Big Data Breach?

Practicing Your Plan









Developing Injects

Possible injects can include:

• 



• 





of organizations believe their

data breach response plan

could be more eective if they

incorporated what they learned

from previous breaches.

74%















Sample Scenarios

• 











• 









• 







Developing Your Drill

• 













• 



• 



Quiz: How Prepared Are You?





Practicing Your Plan

RESPONSE PLANNING











TRAINING AND AWARENESS















KEY PARTNERS



and signed contracts in preparation











COMMUNICATIONS



















NOTIFICATION AND PROTECTION





















SECURITY PLANNING















1. Record the moment of discovery: 





2. Alert and activate everyone: 





3. Secure the premises: 





4. Stop additional data loss: 





5. Document everything: 





6. Interview involved parties: 





7. Review notication protocol: 





8. Assess priorities and risks: 





9. Notify law enforcement: 



HOW A DATA BREACH UNFOLDS

• Data incident is discovered

• Outside legal counsel is engaged

• Forensics determines

“who” and “what”

• “Go/No Go” for consumer

response

• Public Relations

crafts messaging

• Consumer notication

(letter, email. website)

• 1-800 Call Center for

FAQs/Enrollment

• Identity theft Protection/

Fraud Resolution

Responding to

a Data Breach

Breach Discovery





Always collect, document and record as

much information about the data breach



possible, including conversations with

law enforcement and legal counsel.

Act Fast

DISCOVER

INFORM

(Company Incident Lead)

ASSESS

(Forensics)

GUIDE

(Breach Counsel)

NOTIFY

(Breach Response Provider)

BakerHostetler. 2020. Data Security Incident Response Report

1 5

Next Steps



Responding to a Data Breach

IDENTIFY THE CAUSE REPORT TO UPPER MANAGEMENT

ALERT YOUR EXTERNAL PARTNERS

CONTINUE WORKING WITH FORENSICS

IDENTIFY LEGAL OBLIGATIONS









































IDENTIFY CONFLICTING INITIATIVES









EVALUATE RESPONSE

AND EDUCATE EMPLOYEES

















Managing Communications and Protecting Your Reputation













Although incident response planning is not one-size-fits-all, the following are fundamental

principles to abide by:

Assume news of the incident will

leak before your organization has

all the details and have a plan in

place to address questions early

in the process.

If your organization is committed

to providing identity protection if

an incident is conrmed, consider

mentioning that in the statement.

Communicate with the appropriate

regulators early and transparently

to avoid potential scrutiny.

Establish traditional and social

media monitoring to detect leaks and

understand how external stakeholders

are framing the incident.

Focus initial holding statements

on steps being taken to investigate

the issue and resist speculating

on details about the breach before

a forensic investigation.

Ensure frontline employees have

the information they need to

communicate to their customers

and make sure they know to route

any media requests directly to the

incident response team.

When more information is available,

establish a consumer-centric

website regarding the breach

that provides details about what

happened, and steps individuals

can take to protect themselves.

Responding to a Data Breach

Protecting Legal Privilege







While you should consult your outside counsel when deciding the approach to maintaining

privilege, the following are good general rules:

Ensure that all written materials, including emails, are

marked “privileged & condential” and that you include

someone from the legal department on the distribution.

All contracts for external partners should be arranged

through outside counsel, so their work is part of the

course of providing legal counsel to your organization.

Be thoughtful about what information you are documenting

or is being put in writing versus what should be discussed

in-person or on a call.

Responding to a Data Breach

Experian. 2019. Data Breach Consumer Survey

McKinsey & Company. 2019. Survey of North American Consumers on Data Privacy and Protection

Taking Care of Your Customers























Responding to a Data Breach

Notication







• 





• 



• 







• 



• 



• 





Experian and Ponemon. 2020. Seventh Annual Study: Is Your Company Ready for a Big Data Breach?

Responding to a Data Breach

Identity Theft Protection

















• 

• 

• 

• 

• 

• 

of security professionals

believe oering free identity

theft protection and credit

monitoring services is the best

approach to keep customers

and maintain brand reputation.

74%











WHAT IS THE DIFFERENCE BETWEEN IDENTITY THEFT PROTECTION AND CREDIT MONITORING SERVICES?

Auditing Your Plan

Once you’ve created your preparedness

plan, you’ve cleared one of the biggest

hurdles in positioning your organization

for success.

















How the Pandemic Impacts Your

Response Plan









• 





• 



• 









Areas to Focus On

Auditing Your Plan





















• 







• 



• 







• 























• 



• 



• 



• 

• 



• 

CALL CENTER VENDOR NEGOTIATIONS

Auditing Your Plan

Preparedness Audit Checklist





UPDATE YOUR TEAM CONTACT LIST

REVIEW NOTIFICATION GUIDELINES

REVIEW WHO CAN ACCESS YOUR DATA

EVALUATE IT SECURITY











































REVIEW STAFF SECURITY AWARENESS

















DOUBLE CHECK YOUR VENDOR CONTRACTS

VERIFY YOUR PLAN IS COMPREHENSIVE





























A Proactive Approach







• 





• 







• 















Guaranteed and Scalable













• 



• 

• 



• 

• 





• 



• 



• 















is the average

organizations can save

by having an established

incident response team

with an extensively

tested response plan.

IBM and Ponemon. 2020. Cost of a Data Breach Report

Experian®

Reserved Response

$2M

Federal Trade Commission

www.ftc.gov/idtheft

Identity Theft Resource Center

www.idtheftcenter.org

International Association of Privacy Professionals

www.iapp.org

National Conference of State Legislatures

www.ncsl.org

Online Trust Alliance

www.otalliance.org

NIST Cybersecurity Framework

www.nist.gov/cyberframework/csf-reference-tool

• BakerHostetler. 2020. Data Security Incident Response Report

2020_DSIR_Report_(003).pdf

• Experian and Ponemon. 2020. Seventh Annual Study:

Is Your Company Ready for a Big Data Breach?

www.experian.com/Seventh Annual Study

• Experian. 2019. Data Breach Consumer Survey

• Forbes. 2020, March 21. FBI Coronavirus Warning: ‘Signicant

Spike’ In COVID-19 Scams Targeting These Three States

www.forbes.com/FBI Coronavirus Warning

• IBM and Ponemon. 2020. Cost of a Data Breach Report

www.ibm.com

• Identity Theft Resource Center. 2020. 2019 End-of-Year Data

Breach Report

www.idtheftcenter.org

• Identity Theft Resource Center. 2020. Q3 Data Breach Analysis

and Key Takeaways



• INTERPOL. 2020, April 4. Cybercriminals targeting critical

healthcare institutions with ransomware

www.interpol.int

• Keeper Security and Ponemon. 2019. Global State of

Cybersecurity in Small and Medium-Sized Businesses

www.keeper.io

• KIVU. 2020. Threat Intelligence Reports March 2020

kivuconsulting.com

• McKinsey & Company. 2019. Survey of North American

Consumers on Data Privacy and Protection

www.mckinsey.com

• Microsoft. 2020. Digital Defense Report

www.microsoft.com

• PwC. 2020. Digital Trust Insights Pulse Survey

www.pwc.com

• RiskBased Security. 2020. 2020 Mid Year Data Breach

QuickView Report

pages.riskbasedsecurity.com

• Verizon. 2020. Data Breach Investigations Report

enterprise.verizon.com

• VMWare Carbon Black. 2020. Modern Bank Heists 3.0

www.carbonblack.com

Helpful Resources

HELPFUL LINKS REFERENCES

Experian Data Breach Resolution

www.Experian.com/DataBreach

Experian Reserved Response

www.experianpartnersolutions.com/reserved-response/

Blog

www.experian.com/blogs/data-breach/

www.linkedin.com/company/data-breach-resolution

Twitter

www.Twitter.com/Experian_DBR

EXPERIAN LINKS

Notes

Experian Data Breach Resolution, powered by the nation’s

largest credit reporting agency, is a leader in helping

businesses plan for and mitigate consumer risk following

data breach incidents. With more than seventeen years

of experience, Experian Data Breach Resolution has

successfully serviced some of the largest and highest-prole

breaches in history. The group oers swift and eective

incident management, notication, call-center support,

and reporting services while serving millions of aected

consumers with proven credit and identity protection

products. Experian Data Breach Resolution is active with

NetDiligence®, Advisen, and InfraGard.

For more information, visit experian.com/databreach.

About Experian® Data Breach Resolution