All stories carry a lesson, but they usually reveal it only at the end. People are considerably less patient with corporate blogs than with blockbusters and bestsellers, so we would rather give you the lesson right away: When you lose control over customer data, it will affect your reputation. Just ask the Commonwealth Bank of Australia.
A tale of two magnetic tapes
The Australian bank, commonly known as CommBank, recently confirmed that it had lost financial records from 12 million user accounts (including names, addresses, account numbers, and transaction details) dating from 2000 to 2016. What exactly happened?
The data was stored on two magnetic tapes that the bank sent for scheduled destruction, but the supplier failed to provide documentary evidence of their destruction. The bank subsequently hired KPMG as an auditor, whose forensic investigation suggests that the tapes were indeed destroyed—moreover, no fraudulent activity was recorded on the affected accounts, the bank points out—but it is impossible to obtain credible evidence retroactively. Ultimately, this means only one thing: the security of millions of users’ data was compromised.
Just as the General Data Protection Regulation (GDPR) enters into force in the EU on 25 May, Australia has had a similar regulation in place since the beginning of the year, at least in terms of the obligation to report security breaches involving user data. If the whole incident had taken place this year, it would quite possibly have unfolded differently. However, because the bank had no such obligation, it decided not to inform the public until it had to—that is, until journalists learned about the incident. Then the scandal broke.
The value of encryption
Initial reports of the breach suggest that the data on the lost tapes was not protected by encryption. If it had been, the bank could probably have partially avoided the PR disaster despite the initial cover-up—encrypted data would not have been usable even if it had not actually been destroyed and had fallen into unauthorized hands.
With backup software such as Acronis Backup, which enables strong encryption of data on tapes and computers, during online transmission, and when stored in the cloud, CommBank would have been completely secure. It could have used the virtually unbreakable AES-256 algorithm to encrypt customer data across all types of media and, in addition to security itself, gained the trust of its customers, who can appreciate proactive extra measures to protect their sensitive data.
A final thought
The troubles of the Commonwealth Bank of Australia are a good reminder for us at Acronis as well that we need to pay attention to how customer data is handled and protected. The good news is that we have good solutions for this, offering tools such as AES-256 encryption that enable companies to quickly, easily, and comprehensively secure user and customer data, thereby avoiding the harsh impact not only of regulations but also of public outrage.
Article author: ZEBR.ai editorial team
