There is a growing trend where organisations are strictly limiting the amount of information that they disclose in relation to a data breach. Linked is an ongoing example of such a drip feed of PR friendly motherhood statements.

As an ICT professional with 40 years experience, I’m aware that there’s a massive gap between disclosing how something was compromised, versus what data was exfiltrated.

For example, the fact that the linked organisation disclosed that their VoIP phone system was affected points to a significant breach, but there is no disclosure in relation to what personal information was affected.

For example, that particular organisation also has the global headquarters of a different organisation in their building, and has, at least in the past, had common office bearers. Was any data in that organisation affected?

My question is this:

What should be disclosed and what might come as a post mortem after systems have been secured restored?

  • delirious_owl
    33·
    6 months ago

    Please don’t reveal my email address in your data breach announcement, sheesh.

    • thedirtyknapkin@lemmy.world
      4·
      6 months ago

      i mean, i don’t think anyone has actually considered including the leaked data in the leak announcement. it seems so obvious to just say which fields are leaked that i hadn’t even considered that someone might think to include the data itself.

      • delirious_owl
        52·
        6 months ago

        I responded to a comment that said everything. Everything means everything. We should qualify that it shouldn’t be everything.

        There’s literally someone in another comment on this thread saying that they should be able to get the raw data that was leaked from the company on request.