There is a growing trend where organisations are strictly limiting the amount of information that they disclose in relation to a data breach. Linked is an ongoing example of such a drip feed of PR friendly motherhood statements.

As an ICT professional with 40 years experience, I’m aware that there’s a massive gap between disclosing how something was compromised, versus what data was exfiltrated.

For example, the fact that the linked organisation disclosed that their VoIP phone system was affected points to a significant breach, but there is no disclosure in relation to what personal information was affected.

For example, that particular organisation also has the global headquarters of a different organisation in their building, and has, at least in the past, had common office bearers. Was any data in that organisation affected?

My question is this:

What should be disclosed and what might come as a post mortem after systems have been secured restored?

  • tsonfeir@lemmy.world
    141·
    7 months ago

    Every little detail. Including access to the raw data that was leaked (that pertains to the individual). The steps taken to correct the action if possible. The source of the attack, including raw access logs if possible.

    Basically, let me decide how fucked I am, how it happened, and who now has my data.

    • delirious_owl
      101·
      7 months ago

      Please no. I don’t want a copy my passport image included in the announcement about the data leak. Its extremely hard to change my passport, and its better if its not on the official announcement, even if it is being traded on the darknet.

      They should say what data fields were leaked, but not re-leak the actual raw data to the world on the clearnet.

      • tsonfeir@lemmy.world
        3·
        7 months ago

        I didn’t mean they would publish the information to the internet in an insecure way. But I should, if i CHOOSE, get a copy of the leaked data. You don’t have to ask for it.

        • delirious_owl
          31·
          7 months ago

          So you get kyc data on all their other customers? That’s literally a criminal offence in some countries.

          • a4ng3l@lemmy.world
            4·
            7 months ago

            Nha they publish metadata describing the leaked data. If you’re a data subject concerned by the incident you then request a copy of yr information which requires proper identification.

            Why would they share the data itself….