How Sage was hacked, Are you next?

How were sage hacked?

Sage is a large company and is a big player in the SME markets. 280 customers in the UK had data breached they may have had payroll and accounting information stolen. How was this possible?

This was an inside job

An employee at sage was breached due to an insider threat, the employee gained access to the data and accessed it a multitude of times in the weeks leading to the breach report, they used credentials they should not have had. The employee was later arrested at Heathrow airport.

This is now being investigated by the police and the Information Commissioner’s Office (ICO) has been informed. The ICO will likely investigate and if it rules that Sage was negligent in its responsibility towards data protection, it may be punished in the form of a criminal prosecution and fines.

Why are you next?

There are lessons to be learnt here:

Have strict security policies and procedures in place. These include physical security, computer security, internet and computer usage policies, password policies, risk assessments, blue books and staff handbooks.

Make sure your company is doing as much as it can to limit access to computer systems unless essential to be accessed. This will also ensure users have to have secure passwords and documented procedures, have an up to date exit procedure for staff leaving the company and entry procedure for staff coming into the company.

This should include vetting and security checks to make sure you know who you are employing. Conducting regular health checks of procedures and staffing satisfaction should highlight possible ‘disgruntled employees’ who could be a risk.