Explainer: How businesses can reduce risk of data breaches

Cyberattacks growth has been more costly than ever, thereby causing pressure for businesses to protect customers’ data from breaches that can damage reputations, disrupt operations, and trigger regulatory penalties.

From global corporations to small businesses, no organisation has immunity against these cyberattacks.

In recent years, companies including Meta, MGM Resorts, Equifax and Change Healthcare have suffered major breaches that exposed sensitive customer information and highlighted the growing risks facing businesses in the digital economy.

Major data breaches at companies like Change Healthcare and MGM Resorts highlight that digital risks are increasing with attackers exploiting third-party vendors, cloud infrastructure, and software defects.

These incidents often lead to severe consequences, including massive, stolen data sets, ransom demands, and profound, long-term erosion of consumer trust.

Many breaches are preventable if organisations adopt stronger security practices, train employees regularly, and invest in proactive monitoring systems.

The 2017 breach at Equifax remains one of the most damaging examples in corporate history. Hackers exploited a known software vulnerability that had not been patched, exposing the personal data of roughly 147 million people, including social security numbers and addresses.

The incident resulted in billions of dollars in losses, legal settlements, and long-term reputational damage.

Similarly, casino operator MGM Resorts experienced a cyberattack in 2023 that disrupted hotel operations, digital room keys, payment systems, and reservation services across its properties.

The attackers gained access through social engineering tactics that targeted company employees.

Reports say employee-related vulnerabilities remain one of the most common entry points for hackers. Phishing emails, weak passwords, and poor access controls frequently allow cybercriminals to infiltrate corporate systems.

Here’s what businesses can do to reduce the risk of cyberattacks

Businesses can implement multi-factor authentication which requires users to verify their identities through additional security steps beyond passwords.

Strong passwords policy

Businesses should enforce the use of strong password policies and restrict employee access to sensitive systems based on job responsibilities.

Update software

Many attacks exploit vulnerabilities that already have available security patches when organisations fail to update their systems in due time.

The global WannaCry ransomware attack in 2017 spread rapidly through unpatched Microsoft systems, affecting hospitals, businesses, and government agencies in more than 150 countries.

Dedicated security teams

Cybersecurity firms also warn that ransomware attacks are increasing against small and medium-sized businesses, which often lack dedicated security teams.

Attackers encrypt company data and demand payment before restoring access, sometimes threatening to leak stolen information publicly.

Regularly back-up critical data

Businesses need to back up critical data regularly and store backups separately from operational systems. This allows organisations to recover data without paying ransoms if systems are compromised.

Cloud security has also become a critical issue as more companies migrate operations online. Misconfigured cloud databases have caused several high-profile data leaks globally, exposing customer records and confidential corporate information.

There is a need to encrypt sensitive data both during storage and transmission. Encryption converts information into unreadable code, making it difficult for hackers to use stolen data without decryption keys.

Regular cybersecurity audits and penetration

These are increasingly viewed as essential business practices. These assessments help organisations identify vulnerabilities before attackers exploit them.

Governments worldwide are tightening data protection regulations in response to rising cyber threats.

Laws such as the European Union’s General Data Protection Regulation (GDPR) and Nigeria’s Data Protection Act impose obligations on companies to secure customer information and report breaches promptly.

In Nigeria, regulators have intensified conversations around digital trust and data governance as fintech adoption, e-commerce activity, and online services continue to expand.

Cybersecurity is no longer solely just an IT issue but a core business risk with financial and operational implications.

Businesses that fail to prioritise cybersecurity may ultimately lose customer trust, investor confidence, and market value.