Our data continues to be stolen: Companies must take necessary precautions

Ercan KÜÇÜK - 12punto.com.tr

Our digital data continues to be stolen. According to reports, there have been 3 data breaches in November alone, and the data of tens of thousands of people has been stolen. The leaked data includes personal data categories such as identity, personnel records, legal proceedings, transaction security, and union membership information. We discussed digital data breaches with VBT Yazılım General Manager Tayfun Yurdagül.

The Personal Data Protection Board (KVKK) publishes data breaches on its website. According to the latest information, 3 companies reported data breaches in November alone, and the data of tens of thousands of people was stolen. The stolen data returns to citizens as messages and calls from people and organizations they do not know, and even from foreign countries like Indonesia and Malaysia. So, can data breaches not be prevented? What should citizens whose data has been stolen do? We discussed these curious topics with VBT Yazılım General Manager Tayfun Yurdagül.

Yurdagül's answers to our questions and his advice to citizens are as follows:

COMPANIES MUST TAKE TECHNOLOGICAL PRECAUTIONS

We read news about our digital data being stolen almost every day. The KVKK website also shows 3 data breach notifications in the last month. How is this data stolen?

"I think everyone now has the same awareness regarding how valuable digital data is today. As for the methods of data theft, data can be stolen in many ways. Our data can be stolen through employees due to poorly managed authorization mechanisms within an institution, through the increasing cyberattacks we hear about everywhere lately, through methods we call social engineering, and through traditional physical theft."

-What kind of measures should companies take?

"In this regard, the world of security software has of course been working for years and continues to support the sector with new methods and software. Starting with firewalls and antivirus software, you must take technological precautions by correctly configuring solutions such as data loss prevention (DLP) software, endpoint detection and response (EDR) software, and application software security scanning methods in your company, and by having your security vulnerability scans performed continuously. Along with this, training internal employees and conducting awareness studies, which I mentioned earlier, are important for preventing data theft via social engineering."

SANCTIONS FOR FIRMS THAT ALLOW DATA THEFT

-Are sanctions applied to firms that allow data theft?

"The Personal Data Protection Law No. 6698 was published in the Official Gazette dated April 7, 2016, and numbered 29677. The Personal Data Protection Authority, established in relation to this law, has the authority to apply penalties and sanctions regarding the matter. If the data you allowed to be stolen contains personal data belonging to your customers or employees, sanctions are applied.

The definition of personal data is also defined in detail within the same law. Furthermore, if the stolen data is your customers' commercial information, you may be subject to sanctions within the scope of your contract, and you may face high compensation claims depending on the importance of the data."

-It has emerged that our data is being offered for sale on websites. Can these sites not be blocked?

"A site can of course be blocked. Following your application through the prosecutor's office, if deemed necessary, you can have a measure taken regarding access to the site via the BTK (Information and Communication Technologies Authority). However, once data falls onto a site on the internet, we have no idea how many copies of it exist in different locations. Therefore, although blocking it is theoretically possible, the practical application in some processes unfortunately may not be effective."

STOLEN DATA GOES ABROAD

-What should a citizen whose data has been stolen do?

"They need to create a report at the Personal Data Protection Authority's website, https://ihlalbildirim.kvkk.gov.tr/. Additionally, they can personally file a complaint with the relevant authorities on the grounds that the data was obtained and processed unlawfully and pursue the process legally."

-We are constantly receiving calls, messages, and even video call requests from companies and even foreigners on our phones. How do they get our numbers?

"They have likely obtained our information through one of the data theft methods we answered in the first question, from any environment where we previously shared our information. Unfortunately, we receive these calls through our stolen personal data."

-What should be done against this?

"First of all, these numbers should be blocked on our personal devices, and complaint notifications must be made to the relevant official institutions."

-Is there anything you would like to add?

"Data security issues, which have gained a different dimension with the Personal Data Protection Law and the very rapid progress of digitalization, bring significant responsibilities to all companies, regardless of scale. Data security, which is not limited only to KVKK, also covers company employees and processes along with commercial information and secrets. Therefore, as digitalization becomes widespread inside or outside the business, the risk of data security also increases. Consequently, every institution must definitely make investments in determining the existing risks and threats in their own systems and taking the relevant precautions, and must use appropriate solutions for this."

News Source: 12punto