Data Breaches and their fallout - Myth-Buster

Myth 1: “Data breaches only happen to large organisations.”

Reality: Small and medium-sized enterprises (SMEs) are equally, if not more, vulnerable to data breaches. In fact, the 2026 Verizon DBIR found that 43% of breaches involved SMEs, often because they lack the resources, expertise, or awareness to implement robust security measures

Attackers frequently target SMEs as easier entry points into larger supply chains. For example, a 2026 attack on a UK manufacturing SME led to the compromise of a major automotive supplier, resulting in production halts and millions in losses [Source: NCSC, 2026, NCSC Supply Chain Guidance]. Additionally, ransomware gangs often target SMEs, assuming they have weaker defences and less ability to recover.

Why the myth persists: Large breaches (e.g., Equifax, British Airways) dominate headlines, creating a false sense of security for smaller organisations. However, size does not equal safety. SMEs often store sensitive customer data, payment details, or proprietary information, making them lucrative targets.

Actionable advice:

Assume you’re a target, implement basic controls like MFA, regular backups, and employee training.
Leverage free resources from the NCSC (e.g., Small Business Guide) to reduce risk without breaking the bank.

Myth 2: “Our firewall and antivirus software are enough to stop breaches.”

Reality: While firewalls and antivirus (AV) software are essential, they are far from sufficient on their own. Modern cyber threats, such as zero-day exploits, phishing, and insider threats, often bypass traditional defences.

Firewalls primarily block unauthorised network access, but they cannot stop:

Social engineering attacks (e.g., phishing emails tricking employees into revealing credentials).
Insider threats (e.g., a disgruntled employee exfiltrating data).
Advanced malware that evades signature-based AV detection.

The 2026 CrowdStrike Global Threat Report found that 68% of successful breaches involved techniques that bypassed traditional. For example, fileless malware (which resides in memory rather than on disk) is invisible to traditional AV but is increasingly used in ransomware attacks.

Why the myth persists: Many organisations overestimate the capabilities of legacy security tools, assuming they provide comprehensive protection. However, cyber threats have evolved, and defences must too.

Actionable advice:

Adopt a layered defence (defence-in-depth): Combine firewalls, AV, EDR/XDR, MFA, and employee training.
Monitor for anomalies: Use SIEM and UEBA to detect unusual behaviour that traditional tools miss.
Regularly update and patch all systems to close known vulnerabilities.

Myth 3: “If we haven’t been breached yet, our security must be working.”

Reality: The absence of a detected breach does not mean your security is effective. Many organisations operate under a false sense of security because they haven’t detected an attack, but this often means they lack the visibility to see one.

The 2026 ENISA Threat Landscape revealed that the average time to detect a breach is 204 days. Attackers often lurk in networks for months, exfiltrating data or preparing for ransomware attacks without triggering alarms. For example, in a 2025 breach of a European healthcare provider, attackers stole patient records for over a yearbefore being discovered.

Why the myth persists: Organisations often confuse “no news” with “good news”. However, lack of detection ≠ lack of breaches. Many attacks go unnoticed due to:

Poor logging and monitoring.
Over-reliance on perimeter defences (e.g., firewalls).
Insufficient threat hunting (proactively searching for hidden threats).

Actionable advice:

Assume breach: Operate under the assumption that attackers are already in your network.
Improve detection capabilities: Deploy EDR/XDR, SIEM, and NDR to monitor for anomalies.
Conduct regular threat hunts: Use threat intelligence to proactively search for Indicators of Compromise (IoCs).

Myth 4: “Compliance with GDPR means we’re fully secure.”

Reality: GDPR compliance ≠ cybersecurity. While GDPR (and similar regulations like the UK Data Protection Act 2018) sets legal and operational requirements for data protection, it does not guarantee immunity from breaches.

GDPR focuses on data privacy, consent, and breach notification, but it does not prescribe specific technical controls. For example:

Encryption is recommended under GDPR Article 32 but not mandatory in all cases.
Multi-factor authentication (MFA) is not explicitly required by GDPR, yet it is critical for preventing credential-based attacks.
Regular vulnerability scanning is not a GDPR requirement, but it is essential for security.

The 2026 ICO Annual Report highlighted that many GDPR-compliant organisations still suffered breaches due to weak technical controls. For instance, a UK-based fintech company was GDPR-compliant but fell victim to aphishing attack that exposed customer financial data, leading to a £2 million fine.

Why the myth persists: organisations often treat compliance as a checkbox exercise, assuming that meeting regulatory requirements equates to strong security. However, compliance is the floor, not the ceiling.

Actionable advice:

Go beyond compliance: Implement best practices (e.g., MFA, zero-trust architecture, regular penetration testing, red team exercises) even if not legally required.
Use frameworks like NIST Cyber Security Framework (CSF) or NCSC Cyber Assessment Framework (CAF)to strengthen security beyond GDPR’s minimum standards.
Regularly audit and test your security controls to ensure they evolve with the threat landscape.

Myth 5: “Cyber insurance will cover all costs of a data breach.”

Reality: While cyber insurance can mitigate financial losses, it does not cover all costs, and payouts are not guaranteed. Many organisations overestimate their coverage, only to discover gaps when a breach occurs.

A 2026 report by Panaseer and the NCSC found that 40% of cyber insurance claims were denied due to:

Failure to meet policy conditions (e.g., lack of MFA, unpatched vulnerabilities).
Exclusions for certain types of attacks (e.g., nation-state cyberespionage, war-related incidents).
Insufficient evidence of the breach’s scope and impact [Source: Panaseer].

Even when claims are approved, cyber insurance typically does not cover:

Reputational damage (e.g., loss of customer trust, brand devaluation).
Regulatory fines (e.g., GDPR penalties, which can reach 4% of global turnover).
Long-term business disruption (e.g., lost revenue due to downtime or customer churn).
Third-party liabilities (e.g., lawsuits from affected customers or vendors).

For example, Coalition reported a 2025 ransomware attack on a UK logistics firm resulted in £5 million in losses, but their cyber insurance only covered £1.5 million, leaving them financially exposed for recovery costs, legal fees, and reputational harm.

Why the myth persists: Insurance providers market cyber policies as comprehensive solutions, leading businesses to assume full protection. However, policies vary widely, and exclusions are common.

Actionable advice:

Read the fine print: Understand what’s covered (e.g., incident response costs, legal fees) and what’s not (e.g., fines, reputational damage).
Meet policy requirements: Ensure you implement required controls (e.g., MFA, regular backups, patch management) to avoid claim denials.
Supplement insurance with strong security: Treat cyber insurance as a safety net, not a replacement for prevention.

Myth 6: “Our IT team can handle a breach alone.”

Reality: A data breach is not just an IT problem, it’s a business-wide crisis that requires cross-functional collaboration. Relying solely on the IT team can lead to gaps in response, legal risks, and reputational damage.

An effective incident response (IR) involves:

Legal: Ensuring compliance with GDPR, contractual obligations, and regulatory reporting (e.g., 72-hour ICO notification).
HR: Managing internal communications, employee concerns, and insider threat investigations.
PR/Communications: Crafting transparent, empathetic messaging for customers, media, and stakeholders.
Executive Leadership: Making strategic decisions (e.g., ransomware payments, business continuity plans).
Law Enforcement: Engaging NCSC, Action Fraud, or Europol for cybercrime investigations.

A 2026 case study from Mandiant highlighted how a UK financial services firm suffered prolonged downtime and regulatory fines because their IT team attempted to handle a breach in isolation, delaying legal and PR involvement.

Why the myth persists: Many organisations silo cybersecurity under IT, assuming it’s purely a technical issue. However, breaches have legal, financial, and reputational consequences that extend far beyond IT.

Actionable advice:

Develop a cross-functional IR plan: Define roles and responsibilities for legal, HR, PR, and leadership.
Conduct tabletop exercises: Simulate a breach to test coordination between teams.
Engage external experts early: Consider retaining a breach response firm (e.g., cybersecurity consultants, legal counsel) to augment internal capabilities.

Myth 7: “Ransomware attacks only encrypt data, they don’t steal it.”

Reality: Modern ransomware attacks often involve both encryption and data theft, a tactic known as “double extortion.” Attackers not only lock your systems but also exfiltrate sensitive data to increase pressure for payment.

The 2026 CrowdStrike Global Threat Report found that 75% of ransomware attacks now include data exfiltration, with attackers threatening to leak or sell stolen data if the ransom isn’t paid. For example:

In 2025, the Cl0p ransomware gang exploited a zero-day vulnerability in a file transfer tool to steal data from hundreds of organisations, then demanded ransom payments to prevent public.
A UK healthcare provider suffered a double extortion attack in 2026, where attackers encrypted patient records and threatened to sell them on the dark web if the ransom wasn’t paid.

Why the myth persists: Early ransomware attacks (e.g., WannaCry, NotPetya) focused solely on encryption. However, attacker tactics have evolved, and data theft is now a standard part of the playbook.

Actionable advice:

Assume data theft in every ransomware attack: Treat all incidents as potential data breaches and investigate exfiltration.
Implement DLP (Data Loss Prevention): Monitor for unusual data transfers (e.g., large file uploads to external sites).
Prepare for extortion: Develop a ransomware response plan that includes legal, PR, and law enforcement coordination, never pay the ransom without expert advice.

Myth 8: “Our backups are enough to recover from a ransomware attack.”

Reality: While backups are critical, they are not a silver bullet for ransomware recovery. Attackers increasingly target backups to disable recovery options, and restoring from backups is not always straightforward.

Common backup failures include:

Backups are encrypted or deleted: Modern ransomware strains (e.g., LockBit, BlackCat) seek out and encrypt backups before deploying the main attack.
Backups are offline but outdated: If backups are not tested regularly, they may be corrupted, incomplete, or too old to restore critical systems.
Lack of isolation: If backups are connected to the network, they can be compromised along with primary systems.
Slow recovery times: Restoring large datasets (e.g., databases, cloud storage) can take days or weeks, leading to prolonged downtime.

A 2026 report by Veeam found that only 42% of organisations could fully recover from a ransomware attack using backups, while 23% lost data permanently.

Why the myth persists: Many organisations assume backups are foolproof but fail to test them or secure them properly. Attackers exploit this overconfidence.

Actionable advice:

Follow the 3-2-1 rule: Maintain 3 copies of data, on 2 different media, with 1 copy offline and immutable (e.g., air-gapped, write-once storage).
Test backups regularly: Conduct quarterly restore tests to ensure data integrity and recovery speed.
Isolate backups: Store backups in a separate, secure environment (e.g., offline, read-only storage) to prevent tampering.
Monitor backup systems: Use anomaly detection to spot unusual access (e.g., backup deletion or encryption attempts).

Myth 9: “Insider threats are rare and only come from malicious employees.”

Reality: Insider threats are a growing and often underestimated risk, and they aren’t always malicious.

The 2026 Mandiant M-Trends Report found that insider incidents increased by 30% year-over-year, with negligence and human error causing more breaches than malicious intent

Types of insider threats:

Malicious insiders: Employees or contractors who intentionally steal or leak data (e.g., for financial gain or revenge).
Negligent insiders: Well-meaning employees who accidentally expose data (e.g., misconfiguring cloud storage, falling for phishing). 3
Compromised insiders: Employees whose credentials or devices are hijacked by external attackers (e.g., via phishing or malware).

A 2026 case involving a UK financial services firm demonstrated how a negligent employee accidentally shared a spreadsheet containing 50,000 customer records via an unsecured cloud link, leading to a £1.8 million GDPR fine. Meanwhile, Europol reported that a 2025 incident at a European defence contractor revealed that a disgruntled IT administrator exfiltrated classified documents to a foreign government, highlighting the espionage risks of malicious insiders

Why the myth persists:

Organisations focus on external threats (e.g., hackers, ransomware) and underestimate internal risks.
Stigma around insider threats leads to underreporting, many incidents are swept under the rug to avoid reputational damage or legal consequences.
Lack of monitoring: Many companies do not track employee behaviour effectively, missing red flags (e.g., unusual data access, after-hours logins).

Actionable advice:

Implement least-privilege access: Ensure employees only have access to the data they need for their roles.
Monitor user activity: Use UEBA (User and Entity Behaviour Analytics) to detect anomalous behaviour (e.g., large data downloads, unusual login times).
Conduct regular access reviews: Audit user permissions at least quarterly and revoke unnecessary access.
Educate employees: Train staff on data handling best practices and the consequences of negligence.
Encourage reporting: Create a culture of transparency where employees feel safe reporting mistakes without fear of retaliation.

Myth 10: “We don’t need to worry about nation-state cyberespionage, we’re not a government target.”

Reality: Nation-state actors target far more than just governments, they go after private sector organisations in critical infrastructure, technology, healthcare, and finance to steal intellectual property, trade secrets, or sensitive data.

The 2026 ENISA Threat Landscape warns that state-sponsored cyberespionage is on the rise, with China, Russia, North Korea, and Iran among the most active threats.

Why private companies are targeted:

Intellectual property theft: Tech firms, pharmaceutical companies, and defence contractors are prime targets for trade secrets (e.g., AI models, drug formulas, military tech).
Supply chain attacks: Nation-states compromise third-party vendors to gain access to larger targets. For example, CISA reported that the 2020 SolarWinds attack (attributed to Russian hackers) breached US government agencies via a software update from a private IT firm.
Economic advantage: Stealing proprietary data (e.g., patents, R&D) gives foreign competitors an edge.
Disruption and influence: Attacking critical infrastructure (e.g., energy, telecommunications) can destabilise economies or pressure governments.

A 2025 example, reported in the NCSC Annual Review, involved a UK-based semiconductor manufacturer whose design schematics were stolen by a Chinese state-sponsored group, leading to millions in lost R&D investments.

Why the myth persists:

Many businesses assume they’re “too small” or “not strategic enough” to be targeted.
Nation-state attacks are often stealthy, using advanced persistent threats (APTs) that evade detection for months or years.
Attribution is difficult, so many espionage incidents go unreported or are misclassified as cybercrime.

Actionable advice:

Assume you’re a target if you hold valuable IP or data. Industries like tech, healthcare, energy, and finance are high-priority.
Monitor for APT indicators: Use threat intelligence feeds (e.g., NCSC, CISA) to detect nation-state TTPs (Tactics, Techniques, and Procedures).
Segment critical systems: Isolate sensitive R&D, financial, or customer data to limit lateral movement.
Report suspicious activity: If you suspect state-sponsored activity, engage with NCSC, CISA, or Europol for support and intelligence sharing.

Myth 11: “Strong passwords are enough to prevent account takeovers.”

Reality: While strong passwords are a start, they are no longer sufficient on their own. Attackers use sophisticated methods to bypass them, including:

Credential stuffing: Using leaked username-password pairs from other breaches (e.g., LinkedIn, Adobe) to gain access to accounts where users reuse passwords.
Brute-force attacks: Automated tools guess passwords at scale, especially if they’re short or lack complexity.
Phishing: Tricking users into revealing passwords via fake login pages or social engineering.
Pass-the-hash attacks: Exploiting stored password hashes to authenticate without knowing the actual password.

The 2026 Microsoft Digital Defence Report found that 99.9% of account compromise attacks can be blocked with MFA, proving that passwords alone are inadequate.

Why the myth persists:

Many people overestimate password strength (e.g., “P@ssw0rd123!” is easily cracked by modern tools).
Password policies (e.g., 8+ characters, special symbols) create a false sense of security, attackers can crack complex passwords with GPU-powered brute-force tools.
User behaviour undermines security: 65% of people reuse passwords across site.

Actionable advice:

Enforce MFA (Multi-Factor Authentication): Use app-based (TOTP), hardware tokens, or biometric authentication for all critical accounts.
Use password managers: Encourage employees to generate and store unique, complex passwords for each service.
Monitor for credential abuse: Deploy tools that detect anomalous login attempts (e.g., impossible travel, unusual geolocations).
Educate on phishing: Train users to recognise fake login pages and never enter credentials on untrusted sites.

Myth 12: “Cloud providers are responsible for securing our data in the cloud.”

Reality: Cloud security operates on a shared responsibility model, you and your cloud provider each have distinct obligations.

While providers like AWS, Microsoft Azure, and Google Cloud secure the underlying infrastructure, you are responsible for securing your data, applications, and access controls.

A 2026 Gartner report estimated that 95% of cloud security failures are the customer’s fault, often due to:

Misconfigurations (e.g., publicly exposed S3 buckets, over-permissioned IAM roles).
Weak access controls (e.g., no MFA, shared credentials).
Unpatched vulnerabilities in applications or containers.
Lack of monitoring (e.g., no logging or anomaly detection for cloud workloads).

For example, ENISA reported on a breach at a European e-commerce company exposed 200,000 customer recordsafter an AWS S3 bucket was left public due to a misconfiguration.

Why the myth persists:

Cloud providers market their services as “secure by default“, leading businesses to assume full protection.
Many organisations lack clarity on the shared responsibility model, mistakenly believing the provider handles everything.
Misconfigurations are easy to overlook, default settings in cloud services are often permissive (e.g., public access enabled).

Actionable advice:

Understand the shared responsibility model: Review your cloud provider’s security documentation (e.g., AWS Shared Responsibility Model).
Implement least-privilege access: Use IAM policies to restrict user and service permissions.
Enable logging and monitoring: Use cloud-native tools (e.g., AWS CloudTrail, Azure Monitor) to track suspicious activity.
Regularly audit configurations: Use CSPM (Cloud Security Posture Management) tools to detect and remediate misconfigurations.
Encrypt sensitive data: Ensure data at rest and in transit is encrypted using provider-managed keys (e.g., AWS KMS) or customer-managed keys.

Myth 13: “Our cybersecurity insurance will cover ransomware payments.”

Reality: Cyber insurance policies are increasingly excluding ransomware payments, or imposing strict conditions on coverage.

Even if a policy does cover ransom payments, paying the ransom is risky and often discouraged by law enforcement and cybersecurity experts.

Why ransomware payments are problematic:

No guarantee of recovery: The 2026 Sophos State of Ransomware Report found that only 61% of organisations that paid the ransom successfully recovered their data, and 29% were hit again by the same attackers.
Funding criminal enterprises: Paying ransoms finances cybercrime, emboldening attackers to target more victims.
Legal and ethical risks: In some jurisdictions, paying ransoms to sanctioned groups (e.g., Russian or North Korean hackers) may violate anti-terrorism or sanctions laws.
Insurance exclusions: Many insurers now exclude ransomware payments or require pre-approval from law enforcement. For example, Lloyd’s of London has mandated that insurers exclude nation-state attacks from standard policies.

Why the myth persists:

Media coverage often highlights high-profile ransom payments (e.g., Colonial Pipeline’s $4.4M payment in 2021), creating a misleading impression that payments are common and effective.
Insurance brokers may downplay exclusions to sell policies.
Desperation in a crisis: Organisations under pressure may assume payment is the fastest solution, without considering long-term risks.

Actionable advice:

Review your policy carefully: Confirm whether ransom payments are covered and under what conditions.
Develop a ransomware response plan: Include legal, PR, and law enforcement coordination, never pay without expert advice.
Focus on prevention and recovery: Invest in backups, EDR/XDR, and employee training to reduce the need to pay ransoms.
Consider ransomware-specific coverage: Some insurers offer standalone ransomware policies, but weigh the costs and risks carefully.

Myth 14: “Our employees would never fall for a phishing attack.”

Reality: Phishing remains the #1 cause of data breaches, and no organisation is immune.

The 2026 Verizon DBIR found that 36% of breaches involved phishing, with 82% of those targeting human error.

Why phishing works so well:

Sophistication of attacks: Modern phishing emails are highly personalised (e.g., spear phishing, CEO fraud) and often indistinguishable from legitimate messages. Example: A 2026 attack on a UK law firm used AI-generated deepfake voices in vishing (voice phishing) calls to trick employees into transferring funds.
Human psychology: Attackers exploit urgency (e.g., “Your account will be locked in 1 hour!”), authority (e.g., “From: [email protected]“), and curiosity (e.g., “Your payslip is attached”).
Lack of awareness: Even well-trained employees can be tricked by zero-day phishing tactics (e.g., QR code phishing, MFA bypass attacks).

Why the myth persists:

Overconfidence in training: Organisations assume that one-off security awareness sessions are enough, but phishing tactics evolve rapidly.
Blame culture: Employees fear repercussions for falling for phishing, so incidents go unreported.
Underestimating attackers: Many believe their industry or size makes them less likely to be targeted, but phishing is indiscriminate.

Actionable advice:

Conduct regular phishing simulations: Use tools like KnowBe4 or NCSC’s Exercise in a Box to test and train employees.
Implement MFA for all accounts: Even if credentials are stolen, MFA can block 99.9% of account takeovers.
Use email filtering: Deploy advanced threat protection (e.g., Microsoft Defender for Office 365, Proofpoint) to block malicious emails.
Encourage reporting: Create a no-blame culture where employees report suspicious emails without fear of punishment.

Myth 15: “We don’t need a formal incident response plan, we’ll figure it out if a breach happens.”

Reality: Improvising during a breach is a recipe for disaster.

Without a tested incident response (IR) plan, organisations face:

Delayed detection and containment: The average time to contain a breach is 28 days, but with a plan, this drops to under 10 days.
Chaotic decision-making: Without clear roles and responsibilities, teams waste time debating next steps instead of acting decisively.
Regulatory and legal risks: GDPR requires breach notification within 72 hours, failing to meet this deadline can result in fines up to 4% of global turnover.
Reputational damage: A poorly managed response (e.g., delayed communications, misleading statements) can erode trust faster than the breach itself.

A 2026 case involving a European healthcare provider demonstrated the cost of improvisation: After a ransomware attack, the lack of a clear IR plan led to a 3-week delay in restoring systems, a £3 million GDPR fine, and permanent loss of patient trust.

Why the myth persists:

Overconfidence in ad-hoc responses: Many assume their IT team can “wing it” in a crisis.
Lack of awareness of IR frameworks: Organisations may not know where to start with NIST, ISO 27035, or NCSC guidelines.
Perceived cost and complexity: Some view IR plans as expensive or unnecessary until it’s too late.

Actionable advice:

Adopt a framework: Use NIST SP 800-61 or NCSC’s Incident Response Guidance as a template for your plan.
Define roles clearly: Assign specific responsibilities to legal, IT, HR, and PR teams to avoid confusion during a crisis.
Test your plan regularly: Conduct tabletop exercises at least twice a year to simulate breaches and refine your response.
Include third parties: Ensure your plan accounts for vendors, suppliers, and customers who may be impacted or involved in the response.

Myth 16: “Encryption makes our data 100% secure.”

Reality: While encryption is a critical security control, it is not a silver bullet.

Encrypted data can still be compromised in several ways:

Key management failures: If encryption keys are stolen, weak, or mismanaged, attackers can decrypt your data. For example, hardcoded keys in applications or keys stored in plaintext are common vulnerabilities.
Endpoints and memory: Encryption protects data at rest and in transit, but not when it’s in use. Attackers can steal data from memory (e.g., via RAM scraping) or keyloggers that capture decrypted data as it’s being processed.
Misconfigurations: Improperly configured encryption (e.g., weak algorithms like DES or RC4) can be broken by modern computing power.
Side-channel attacks: Attackers can exploit implementation flaws (e.g., timing attacks, power analysis) to infer encryption keys without directly breaking the algorithm.
Insider threats: Authorised users with access to decryption keys (e.g., employees, contractors) can exfiltrate or misuse encrypted data.

A 2026 case involving a UK financial institution demonstrated this risk: Despite encrypting customer databases, an insider with access to the decryption keys stole and sold data to a competitor.

Why the myth persists:

Marketing hype: Vendors often oversell encryption as a complete solution, leading to overconfidence.
Lack of understanding: Many assume that encryption alone is enough to comply with GDPR or other regulations, but Article 32 of GDPR requires additional measures (e.g., access controls, regular testing).
False sense of security: Organisations may neglect other controls (e.g., MFA, monitoring) if they believe encryption is infallible.

Actionable advice:

Use strong encryption standards: Implement AES-256 for data at rest and TLS 1.3 for data in transit.
Secure your keys: Store encryption keys in hardware security modules (HSMs) or trusted key management services (e.g., AWS KMS, Azure Key Vault).
Combine with other controls: Layer encryption with MFA, DLP, and monitoring to defend against multiple attack vectors.
Monitor for anomalies: Use SIEM and UEBA to detect unusual decryption activity (e.g., large volumes of data being accessed or exfiltrated).

Myth 17: “We don’t need to worry about IoT devices, they’re not critical to our operations.”

Reality: Internet of Things (IoT) devices, from smart thermostats to industrial sensors, are a growing attack vector that can compromise entire networks.

The 2026 ENISA Threat Landscape warns that IoT botnets (e.g., Mirai, Mozi) are increasingly used for DDoS attacks, data exfiltration, and lateral movement.

Why IoT devices are a risk:

Weak default credentials: Many IoT devices ship with hardcoded or default passwords (e.g., admin/admin), making them easy to hack.
Lack of patching: Manufacturers rarely provide security updates, leaving devices vulnerable to known exploits.
No encryption: Many IoT devices transmit data in plaintext, allowing attackers to intercept sensitive information.
Network segmentation failures: IoT devices connected to corporate networks can serve as entry points for attackers to move laterally and compromise critical systems.

A 2026 attack on a UK manufacturing plant demonstrated the real-world impact: Hackers compromised an unpatched IoT sensor on the production line, then moved into the IT network, causing a 3-day shutdown and £2.5 million in losses.

Why the myth persists:

Perceived low value: Many organisations assume IoT devices don’t store or access sensitive data, but they can be gateway devices to critical systems.
Lack of visibility: IT teams often don’t know how many IoT devices are on their network, let alone how to secure them.
Assumption of vendor security: Businesses trust that manufacturers have built-in security, but most IoT devices lack basic protections.

Actionable advice:

Inventory all IoT devices: Use network scanning tools (e.g., Nmap, Forescout) to discover and classify IoT devices.
Change default credentials: Always replace factory-default passwords with strong, unique credentials. If your device does not allow these credentials to be changed, consider switching to a vendor that allows this basic security measure.
Segment IoT networks: Isolate IoT devices on a separate VLAN with strict access controls to prevent lateral movement.
Disable unnecessary features: Turn off unused services, ports, or protocols (e.g., Telnet, FTP) that could be exploited.
Monitor IoT traffic: Use NDR (Network Detection and Response) to detect anomalous activity from IoT devices.

Myth 18: “Our security team can stop every breach before it happens.”

Reality: No security team can stop 100% of breaches, prevention is not perfect, and assuming otherwise is dangerous.

Even the most well-funded, skilled security teams face sophisticated, persistent threats that can bypass defences.

Why breaches still happen:

Zero-day exploits: Attackers use unknown vulnerabilities that no patch or signature can detect.
Human error: Mistakes by employees (e.g., clicking a phishing link, misconfiguring cloud storage) are impossible to eliminate entirely.
Insider threats: Malicious or negligent insiders can bypass even the strongest external defences.
Evolving attack methods: AI-powered attacks (e.g., deepfake phishing, adaptive malware) are increasingly hard to detect.
Third-party risks: Supply chain attacks (e.g., SolarWinds, Kaseya) exploit trusted vendors, making them difficult to defend against.

The 2026 IBM Cost of a Data Breach Report found that only 33% of breaches were detected by internal security teams, the rest were discovered by external parties (e.g., customers, law enforcement, or attackers themselves).

Why the myth persists:

Overconfidence in technology: Many organisations believe their tools (e.g., EDR, firewalls) are infallible, but no single control can stop all threats.
Fear of admitting vulnerability: Some downplay risks to avoid reputational damage or regulatory scrutiny.
Lack of incident response testing: If a team never tests their detection and response, they may overestimate their capabilities.

Actionable advice:

Adopt a “defence-in-depth” strategy, with multiple layers of defence including continuous authentication, network segmentation, boundary controls, internal controls and continuous monitoring and analysis.
Assume breach mindset: Operate under the assumption that attackers are already inside your networkand focus on detection and response as much as prevention.
Invest in monitoring and threat hunting: Use SIEM, EDR/XDR, and UEBA to detect anomalies that traditional tools miss.
Regularly test your defences: Conduct penetration tests, red team exercises, and phishing simulations to identify gaps.
Prepare for failure: Develop a robust incident response plan and test it frequently to ensure rapid recovery when breaches occur.

Myth 19: “Small data breaches don’t require a formal response.”

Reality: Even small breaches can have outsized consequences and must be treated seriously.

Under GDPR, any breach involving personal data must be assessed for risk, and failure to report when required can result in fines.

Why small breaches matter:

Regulatory obligations: GDPR Article 33 requires reporting any breach likely to result in a risk to individuals’ rights and freedoms, regardless of size. For example, a 2026 breach where just 500 customer email addresses were exposed still triggered an ICO investigation because the data was used in a follow-on phishing campaign
Escalation risk: A small breach (e.g., one compromised account) can lead to a much larger incident if attackers use it to move laterally or exfiltrate more data.
Reputational damage: Even minor breaches can erode customer trust if handled poorly. For example, a 2025 incident where a UK charity accidentally emailed donor details to the wrong recipients led to public backlash and a 20% drop in donations.
Legal and contractual risks: Many customer contracts and industry regulations (e.g., PCI DSS for payment data) require immediate reporting of any breach, no matter the size.

Why the myth persists:

Underestimation of impact: Organisations may dismiss small breaches as insignificant, not realising the potential for escalation.
Fear of overreacting: Some worry that reporting minor incidents will damage reputation or waste resources.
Lack of awareness: Many don’t know the legal requirements for small breaches under GDPR or sector-specific regulations.

Actionable advice:

Treat every breach as serious: Investigate, contain, and assess the risk, even if it seems minor.
Document everything: Keep detailed records of the breach, your response, and any remediation steps for compliance and audits.
Report if required: If the breach involves personal data and poses a risk to individuals, report it to the ICO within 72 hours.
Communicate transparently: Even for small breaches, inform affected individuals if there’s a risk of harm (e.g., phishing, identity theft).

Myth 20: “Cybersecurity is just an IT problem.”

Reality: Cybersecurity is a business-wide risk that impacts every department, from finance and HR to legal and customer service.

Treating it as solely an IT issue leads to gaps in defence, slow response times, and increased damage when breaches occur.

Why cybersecurity is everyone’s responsibility:

Finance: Payment fraud, ransomware, and business email compromise (BEC) can disrupt cash flow and lead to financial losses. Finance teams must monitor for unusual transactions and enforce MFA for payment systems.
HR: Employee data (e.g., payroll, personal details) is a top target for attackers. HR must secure sensitive records, conduct background checks, and train staff on security policies.
Legal: GDPR compliance, breach notifications, and contractual obligations fall under legal’s purview. Failure to meet regulatory requirements can result in heavy fines.
Customer Service: Phishing and social engineering often target customer-facing teams. Staff must be trained to recognise and report suspicious requests.
Executive Leadership: Cybersecurity is a board-level risk. Executives must allocate budget, set priorities, and foster a culture of security awareness.

A 2026 survey by PwC found that organisations with board-level cybersecurity oversight were 3x more likely to detect and contain breaches quickly.

Why the myth persists:

Historical siloing: Cybersecurity has traditionally been seen as an IT function, leading to narrow ownership.
Lack of awareness: Non-technical teams may not understand their role in preventing or responding to breaches.
Budget constraints: Some organisations prioritise IT spending over broader security initiatives, leaving other departments unprepared.

Actionable advice:

Build a Cyber-Aware Culture: Make cybersecurity awareness part of onboarding, training, and performance reviews.
Assign cross-functional roles: Ensure every department has a security champion who understands their responsibilities.
Conduct regular cross-team exercises: Run tabletop simulations that include IT, legal, HR, finance, and PR to test coordination.
Align security with business goals: Frame cybersecurity as a business enabler (e.g., protecting revenue, reputation, and customer trust) rather than a cost centre.

Final Thoughts

Data breaches are inevitable, but their impact is not. By debunking these myths, organisations can adopt a more realistic, proactive, and resilient approach to cybersecurity. Prevention, detection, response, and recovery must all be prioritised, and everyone, from the board to frontline employees, has a role to play.

Next steps:

Assess your assumptions: Review your current security posture against these myths.
Test your defences: Conduct a gap analysis and penetration test to identify weaknesses.
Educate your team: Share this myth-buster with stakeholders to foster a culture of security awareness.
Stay informed: Follow NCSC, ENISA, and CISA for up-to-date threat intelligence and best practices.

Visit our Further Reading page for a wide range of resources, frameworks, guidance and inks to research organisations and respected commentators.

Data Breach Blog Post

Data Breach FAQ

Get in Touch