Facebook, the social media giant is set to face a fine of up to £1.25 billion after revealing that 50 million user accounts were compromised on Tuesday 25 September, with affected users being notified via their Facebook accounts.

This recent data breach has been established as the largest security breach Facebook have faced. It is also one of the more severe breaches, as the hackers obtained “access tokens”, which are a form of security key allowing users to browse Facebook on numerous devices without entering a password.

Obtaining these “access tokens” allowed the hackers to gain full access to a user’s account, including third party applications.

Facebook’s CEO, Mark Zuckerberg addressed the security breach, stating:

Since news broke regarding the British Airways data breach, the airline - which is already facing massive fines of up to £500 million from the Information Commissioner’s Office – is now set to face legal action from customers who have suffered financial losses.

The legal action was instigated by SPG Law, who are seeking compensation for their clients, not only for their financial losses, but also claiming costs for the “inconvenience, distress, and misuse” of their personal data.  

SPG Law confirmed that they have sent the airline a “Letter before action” document, in order to commence discussion regarding settlement. Within the letter, it states that If BA refuse to cooperate this will result in group litigation, which would allow the courts to manage numerous cases against them at once.

Tom Goodhead, a Partner at SPG Law discussed the airlines failings, stating:

According to the Irish Garda National Cyber Crime Bureau, there has been a recent increase of cyber crime involving criminals utilising social media to hack user data. They are doing so by checking when a customer contacts their banks and then posing as the bank in order to obtain their data.

Detective Superintendent, Michael Gubbins stated the cyber criminals utilising social engineering to hack data is “at the very top”of potential threats. He also discussed how these threats are becoming harder to detect, due to the increase in what is known as “fileless” malware, which is not stored within the hard drive but in RAM, a temporary storage space, and therefore harder to track.

He also discussed how crypto-currency such as Bitcoin has enabled a new wave of cybercrime, as criminals target users in order to obtain their digital currency.

As cybercrime continues to rise affecting several large organisations who have had their personal data accessed or stolen, it is now vital that everyone considers and evaluates the best cybersecurity solutions to protect their business.

Recently, both small and medium organisations have been urged by the Business Fraud Prevention Partnership (BFPP) to seriously consider protection against cyber-crime. The founder of the BFPP, Edward Whittingham discussed misconceptions regarding cyber-crime, stating:

Industry group, UK Finance have discovered that customers of UK banks have had more than £500m stolen from their accounts at the start of this year. This consisted of £358m being lost to unauthorised fraud and £145m being obtained through authorised push payment (APP) scams. The difference being banks usually refund unauthorised fraud victims, whereas APP victims are rarely refunded.

At the start of 2017, APP scams hit a total of £101m, and this number has now shown an increase of £44m, since four more banks reported fraud data.

UK Finance’s managing director for economic crime, Katy Worobec discussed how the new figures highlighted fraud as a top “major threat” in the UK. She also stated that the money obtained from bank accounts are used to fund terrorism, people smuggling and drug trafficking.”

Following Google’s announcement this week (8 October 2018) regarding a data breach in 2015, they have temporarily shut down their social network Google+, where a security bug enabled third party developers to gain access to user data, potentially affecting around 496, 951 Google+ users.

The announcement on Monday was the first time Google discussed the breach, which although occurred three years ago, was not exposed and remedied until March 2018. Google’s reasoning for late exposure was relayed in an internal memo, which discussed the avoidance of “regulatory interest”, and potential comparisons to Facebook’s Cambridge Analytica scandal.

The bug may have allowed third party developers to gain access to usernames, email, gender, data of birth, location, pictures, as well as occupation and relationship status. However, there is no concrete evidence to confirms this (as Google only holds API data for two weeks) therefore they cannot determine how many users were exposed. Google have advised that there was “no evidence that any profile data was misused” as well as there being “no evidence that any developer was aware of this bug, or abusing the API”.

According to recent survey, 17 out of 24 regulatory authorities were unprepared for the General Data Protection Regulation (GDPR), when it was introduced on 25 May 2018.

Regardless of these statistics, organisations cannot afford to become complacent, as all businesses are at risk of data breaches. Therefore, GDPR compliance must be continually enforced.

According to the British security company, SureCloud, there have been an influx of Wi-Fi routers hacked in millions of homes across the UK.

SureClouder researcher Elliott Thomson, who discovered the reported Wi-Fi hacks, stated:

“The hacker would be able join the Wi-Fi network, access shared files, access ‘internet of things’ devices which trust the local network”

He also reported that a hacker could access web browsing history:

The UK newspaper industry’s trade body has urged for new ruling to be implemented regarding social media sites, regulation, and their funding contribution to journalism. This could mean sites such as Google and Facebook would take on both financial and legal responsibility in relation to content published on their platforms.

The News Media Association (NMA), which represents the majority of local and national newspapers in the UK, also urged Facebook to fund newspapers who have their stories featured in newsfeeds, regardless of whether the stories are read.

The NMA also urged the government to implement a tax credit system, similar to that of British film industry investment, which enables newspapers to claim cash rebates for investment in ventures such as investigative journalism.

October is Cyber Security Awareness Month, which means organisations should be considering their current cybersecurity measures in an effort to prevent data breaches and cyber threats. The need to improve cybersecurity has also been amplified since results from the Cyber Security Breach Survey 2018 established that 43% of businesses have suffered a data breach in the last 12 months.

Small businesses especially should be evaluating their cybersecurity measures, as according to research from security firm Sitelock, smaller organisations are actually more at risk of a website hack, mainly due to their lack of cybersecurity and website maintenance.

Laura Dodge, Marketing Manager at Pedalo, the web development agency discussed the indispensability of implementing cybersecurity and website maintenance, stating:

Experts believe that the greatest threat to an organisation is not its lack of cybersecurity, it is actually the employees who tend to cause the most damage.

This comes after 77% of survey respondents indicated that regardless of training and adherence to company policies, it is actually employees that are the main source of cyber-attacks, as they may be unaware of the warning signs. Therefore, it is vital that companies improve cybersecurity training by implementing ways for staff to protect, as well as how to conduct themselves online, especially on social media.

As social media is an integral part of engagement - and with that comes an inherent level of trust - meaning it is vital that everybody is aware of what is safe when positing content. This is particularly the case for employees who are responding to their customers, as they must be aware of online actors who utilise fake accounts in order to pose as customers and purposely target staff and the organisation.

Recently, cyber criminals have become more focused on intellectual property due to its prolonged benefits, resulting in them targeting industries such as the manufacturing sector, which is the third most targeted industry for cyber-crime.

The manufacturing industry is also not obligated to report breaches unlike the healthcare, financial, and retail sectors, therefore it is possible that there are a lot of cyber-attacks that have gone unreported, which potentially increases the risk of cyber-crime

Manufacturing organisations usually receive correspondence containing confidential information such as contracts, patents, drawings and additional private content, which must be protected. The problem is that a lot of manufacturing companies underestimate the threat of cyber-attacks, and therefore do not implement the necessary cyber security and protection that is necessary to safeguard their confidential information.

Before Brexit is finalised, there is a lot of work to be done, with one of the most recent priorities being data transference between the UK and the EU. This is because both the Government and businesses have expressed their reservations regarding personal data traffic post-Brexit, especially in the event of a ‘no deal’ Brexit. 

In order to combat this issue, a new Data Law Committee has been implemented in order to discuss future legislation regarding Data Protection and Privacy law. The City of London Law Society announced the introduction of the Data Law Committee, with Jon Bartley, the chairman of the committee describing it as “pivotal moment” for Privacy law.

The Committee is in place in order to discuss all aspects of Data Privacy and Cybersecurity legislation. However, Jon Bartley, the Committee Chairman and Partner at the Corporate and Insurance law firm Reynolds Porter Chamberlain, announced that Brexit is “our first and most urgent area of interest.”.

The Director at the Serious Fraud Office (SFO), Lisa Osofsky, has recently announced her plans to utilise artificial intelligence in order to deal with fraud cases that are data- heavy.

Osofsky, the former FBI Lawyer discussed the SFO’s plans in her first speech since taking on the chief role:

In an effort to improve internet regulations, the government’s Home Office and the Department for Digital, Culture, Media and Sport (DCMS) are currently drafting legislation in order to regulate “social harms” online.

The proposed regulator has been labelled as the internet equivalent to Ofcom – the regulator of broadcasting, telecommunications and postal infrastructures. As similar to Ofcom, the regulation intends to include a mandatory code of practice for social media and websites. The Home Secretary, Sajid Javid and Culture Secretary, Jeremy Wright, are currently considering the terms of the Code of Practice. The terms are set to include age verification on social media sites, as well as a rule enforcing all sites to remove any harmful content within a specific time frame or instead face fines.

The Head of Ofcom, Sharon White, recently announced a call to action regarding the regulation of tech companies:

In a recent security report, which analysed 850 cyber-crimes against UK universities and colleges from 2017 to 2018, there was clear evidence to show that the cyber-attacks were often committed by disgruntled students or staff members within these organisations.

The report was conducted by the government-funded agency, Jisc,who discovered that the crimes were not being committed by professional hackers or organized crime groups, but instead the perpetrators were much closer to home.  This conclusion was made due to the attacks showing “clear patterns” of activity during term times, whilst attacks were reduced during holiday periods.

Dr John Chapman, the head of security operations at Jisc, who assists with providing technology services to the higher and further education field, stated:

According to Action Fraud’s cyber statistics, there were 12,372 cyber-crime reports made between October 2017 and March 2018, which resulted in victims losing a total of £28 million.

Action Fraud, the national fraud and cyber-crime reporting centre is led by the City of London Police. As one of the founding members of the Global Cyber Alliance, The City of London Police also run Cyber Protect, which along with Action Fraud was put in place, in order to investigate, detect, and protect individuals and organisations from cyber-crime and fraud.

Action Fraud’s statistics show that out of the 12,372 cyber-crimes reports, 4,796 were reports of social media and email accounts being hacked, which resulted in victims losing a total of £11 million.

It is most likely that the reported cyber-crimes were committed by criminals unbeknownst to the victims, as statistics show that around 50% of cyber-crime and fraud is conducted abroad.

In relation to the Action Fraud statistics, The Temporary Commander, Pete O’Doherty of the City of London Police, stated the following: