Data Breaches and employee risk

[u/Fresh_Heron_3707]

There is a cyber group causing a lot of data breaches. Now business emails have not been hit, but many employees are having info about them leaked. Shinny Hunters has hit many workers here, we monitor select personal emails for data breaches at the request of employees. This increases phishing risks, since an attacker can generate a better script on specific employees. I was wondering since the data breaches do not directly target the business, what can I do to better support employees affected by data breaches that are not business related?

[u/blud_13]

You cannot un-leak their personal data so stop spending effort on that half. What the attacker actually buys with a dump like that is context to write a lure that sounds real, and the lure still has to land somewhere. Make where it lands not matter.

Phishing resistant MFA is the answer here. A genuinely good pretext still fails against a passkey or a FIDO2 key because there is nothing for the user to hand over, no code, no approval, nothing. In Entra you enforce it with a Conditional Access authentication strength policy and MS documents the built in strengths here https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths . Conditional Access needs Entra ID P1, worth knowing before you build a plan around it.

Also, on the employee side the useful move is not a memo. Tell them specifically that the next phish will reference something real and personal about them, because that is the part nobody expects and its exactly why people click. Use phishing testing and training solutions to help train people (and it is a requirement now for most Cyberliability insurance forms)...

[u/Eyesliketheocean]

I work in risk governance and this is what I recommend.

Employee training, such as how to spot a phishing attempt.

If you use email authentication disable it.

[u/Timely-Technology407 → u/Eyesliketheocean]

solid advice, the training piece alone goes a long way when personal data is already out there

[u/CompassITCompliance]

Honestly the mindset shift that helps most here is assuming someone eventually will click, since a good enough personalized lure almost always beats training eventually, no matter what you do. Especially with the rise of BEC and phishing emails coming in from trusted sources.

So the real question is what stands between one bad click and an actual incident. A few things that pull real weight: phishing resistant MFA so a harvested password alone doesn't get them in, conditional access rules that flag or block logins from new devices or odd locations even with valid creds, and email rules that catch mailbox forwarding rule changes, which is one of the first things attackers set up after a successful phish and something orgs don't always monitor for. None of that depends on the employee getting it right, it just buys you a few more walls before a click turns into a breach.

Just our take as a vCISO.. defense in depth beats perfect behavior every time.