Mandatory notification of data breach terminology

Failure to use Blind Carbon Copy (BCC) when sending email

Sending an email to a group of people and placing all recipient emails addresses in the ‘To’ field, thereby disclosing all recipient email addresses to all recipients

Failure to redact personal information

Failure to de-identify and/or delete personal information from a document record before it is disclosed

Incorrect personal information attached to a client file

Personal information is attached to a client file which is then subsequently accessed or disclosed

Insecure disposal

Disposing of personal information documents in a manner that results in unauthorised loss or disclosure. For example, placing documents in a public bin to dispose of customer records instead of the secure disposal bin

Loss of paperwork or data storage device

The physical loss of personal information. This may be where an employee accidently leaves a client folder on a train or leaves a work laptop in a taxi

Personal information sent to the wrong recipient

Personal information sent to the wrong recipient via email, fax, post, courier service or other electronic method

Unauthorised access

Where personal information is accessed without authority or a purpose that is not directly related to the persons duties or work functions

Unauthorised verbal disclosure

Verbally sharing personal information without authorisation. This may include sharing or openly discussing sensitive medical information in a hospital waiting room

Unauthorised disclosure by unintended release or publication

Unauthorised disclosure of personal information in writing, sending a letter to the wrong address, but with the correct name or publishing information online

Theft of paperwork or data storage device

Theft of a physical device or paperwork containing personal information

Social engineering/impersonation

Directed attack that relies heavily on human interaction to manipulate people into breaking normal security procedures and best practices to gain access to systems, networks or physical locations

Rogue employee/insider threat

Intentional attack by an employee or insider (e.g. contractor) conducting activities that are not in the interest of the employer or other entity

Cyber incident

A cyber incident targets computer information systems, infrastructures, computer networks or personal computer devices

Malware

Short for ‘malicious software’. Software used to gain unauthorised access to computers, steal information and disrupt or disable networks. Types of malware include trojans, viruses and worms

Ransomware

Malicious software that makes data or systems unusable until the victim makes a payment

Phishing (compromised credentials)

Untargeted, mass messages sent to many people asking for information, encouraging them to open a malicious attachment, or visit a fake website that will ask the user to provide information or download malicious content

Brute force attack

A typically unsophisticated and exhaustive process to determine a cryptographic key or password that proceeds by systematically trying all alternatives until it discovers the correct one

Compromised or stolen credentials (method unknown)

Credentials are compromised or stolen by methods unknown

Hacking

Unauthorised access to a system or network (other than by way of phishing, brute-force attack, or malware), often to exploit a system’s data or manipulate its normal behaviour

Business email compromise

A form of cybercrime that uses email fraud to attack an organisation to achieve a specific outcome that negatively impacts the target organisation

Mail merge failure

A system failure which results in personal information being misdirected to the incorrect individual

Unintended release or publication

A system failure which results in the release or publication of personal information