1. Incident Overview
What happened?
A phishing attack led to unauthorized access to the customer database, exposing personal data. When and how was the breach discovered?
The breach was detected on March 10, 2025, during a routine security audit when an unknown IP address was flagged for unusual data access. What type of personal data was involved?
- Full names
- Email addresses
- Phone numbers
- Partial credit card information (last four digits)
2. Cause of the Breach
- Why did the breach occur?
The breach resulted from a phishing attack where an employee mistakenly provided login credentials to a malicious actor. - Were security measures in place?
- Two-factor authentication (2FA) was not enforced for database access.
- Employees received security awareness training, but phishing simulations were not conducted.
3. Impact Assessment
| Impact Category | Details |
| Individuals Affected | 5,200 customers |
| Data Exposed | Names, emails, phone numbers, partial credit card info |
| Potential Risks | Identity theft, phishing scams, financial fraud |
4. Timeline of Events
| Date & Time | Event |
| March 8, 2025 – 10:15 AM | Employee received phishing email and entered credentials. |
| March 9, 2025 – 03:30 AM | Unusual database access from foreign IP detected. |
| March 10, 2025 – 09:00 AM | IT security team discovered breach during an audit. |
| March 10, 2025 – 11:30 AM | Immediate access revoked and forensic investigation started. |
| March 11, 2025 – 02:00 PM | Affected users notified and advised to remain cautious. |
5. Response Actions
What has been done to contain the breach?
- Suspended compromised accounts.
- Blocked unauthorized IP access.
- Conducted a forensic investigation to identify affected records.
Steps taken to mitigate risks
- Notified affected individuals and advised password changes.
- Partnered with cybersecurity firms for vulnerability assessment.
- Reported breach to data protection authorities within 72 hours.
6. Future Prevention Measures
What actions will be taken to prevent similar breaches?
- Mandatory 2FA for all employees handling sensitive data.
- Regular phishing awareness training and simulated phishing tests.
- Enhanced logging & monitoring for suspicious activities.
- Updated access control policies to restrict unnecessary data access.