Key Points:

• A data leak is the exposure of sensitive data to unauthorised individuals, often due to employee negligence, and highlights the potential risks associated with data leaks.
• Common causes of data leaks include weak access controls, social engineering, weak passwords, malware, insider threats, user error, misconfigurations, physical attacks, shadow IT, and the buildup of old data.
• Risks of data leaks include financial and reputational losses, disruptions to business, identity theft, and legal consequences.

What is a data leak?

A data leak occurs when sensitive data is exposed to those who shouldn’t have access to it.

It’s often not intentional; rather than a data breach where malicious actors may hack into a system, data leaks can occur as a result of negligent employees not securing information in the correct way.

However, if a data leak happens, it can lead to a data breach if sensitive information gets into the wrong hands.

What are the biggest risks?

There are a few risks associated with data leaks, including:

• Financial loss - hefty penalties and investigation costs can see your business shelling out
• Reputational loss - customers can lose trust if they can see you haven’t been careful with their data
• Disruption to business - while investigations are ongoing, and your security team are tightening things up, there could well be a disruption to business as usual
• Identity theft - those who have had their data leaked could be the victims of identity theft, putting your business even more at risk of legal battles and reputational losses
• Legal consequences - you could be faced with legal challenges from those affected, as well as any authority bodies who claim you haven’t complied with their regulations

What are the most common causes of data leaks?

1. Access controls aren’t strict enough

If sensitive documents aren’t managed properly, you can end up giving access to too many people, which maximises the chance of data being leaked.

You should ensure the tightest access controls are in place to lock down your most sensitive data. You might even want to consider using a zero-trust model to take a least privilege approach, and put the most protections in place.

2. Social engineering

Social engineering attacks are becoming more sophisticated all the time. Hackers can pose as managers, IT teams, or even the CEO, to trick employees into sharing sensitive information.

The only way you can get around this is to train your staff effectively to spot social engineering attempts. That could take the form of practice runs to see whether your team can identify a genuine request or a social engineering attack.

3. Weak passwords

Around 80% of data breaches can be linked back to weak login details, meaning they could have been prevented if employees had tightened up their security credentials.

To discourage the use of easy-to-guess passwords, you should make sure your employees are using password managers such as 1Password. This can help them see that they don’t have to use the most memorable passwords as they’ll have everything stored in the password manager instead.

4. Malware

Malicious software can be downloaded onto an employee’s computer easily if they open any dodgy websites, or click on any suspicious links in emails.

Again, you’ll need to let your team know the dangers that malware can pose, and how they can avoid being affected by it.

5. Insider threats

Disgruntled employees can pose a threat to your business, particularly if they have access to sensitive data. This is where tightening your access controls can come into play effectively, as you can minimise their ability to access sensitive information.

You should also take care to look for anomalous behaviours such as employees attempting to share documents to external parties, or downloading sensitive documents that could pose a threat to your business.

6. User error

Minimising the chances of user errors occuring is key, when it comes to reducing the chance of data leaks.

Rich Vibert, CEO of Metomic says:

“Around 80% of data leaks involve a human element, and it’s not always malicious. It’s mainly the result of employees who aren’t following security best practices. Having a human firewall in place - a team of people who prioritise data security - can bring the risk to your business right down.”

7. Misconfigurations

If tools are not set up correctly from the off, it can leave data exposed. For instance, if your Notion pages are published to the web, and accessible to anyone on the internet, you’re putting your sensitive data at risk.

Not only that but competitors will also be able to see your latest plans, or revenue targets - a chance you don’t want to take.

8. Physical attacks

While a lot of data lives in the cloud these days, there are still the physical elements of security that can’t be ignored.

Whether it’s a dodgy USB or stolen devices, sensitive data can be leaked from physical attacks so you should let your team know how to keep their devices safe. For instance, don’t leave it in the car overnight or make sure it’s locked away in a desk.

9. Shadow IT

Employees are using unapproved apps to get things done quickly, but this can often be done behind the backs of security teams who are unaware of the apps being used. This means the correct protections can’t be put in place, and sensitive data can be shared across insecure devices.

This can also be an issue if employees are using their own devices rather than company ones, as the correct firewalls may not be in place.

10. Build up of old data

When employees leave a business, they can leave behind many files that contain plans, stats, and data that could prove useful to a bad actor. To avoid old data building up, and minimise the data in your SaaS apps, you should delete data that is no longer needed, and remove permissions to files they no longer need access to.

How to prevent data leaks with Metomic

Metomic's data security software can accurately detect PII, PHI, financial data, IPs and company secrets to help you reduce the amount of sensitive data in SaaS apps like Slack, Google Drive, Office365 and many more.

With less data in your SaaS apps, there will be less chance of data sprawling, and if a bad actor were to pose a threat to your business, there wouldn’t be much data they could get their hands on.

Take a look at our free Google Drive scanner to see how it all works, and how we could help you discover where your sensitive data is hiding.