Government data leakages and cyber hygiene among civil servants

Government data leakage implies exposure of sensitive data resulting from various internal triggers (either digital or physical, often accidental), in contrast to data breaches which are caused by intentional cyberattacks.

The top reasons of data leakage include:

• overlooked software vulnerabilities (‘zero-day vulnerabilities’), 
• misconfiguration issues (misconfigured software and cloud storage settings, e.g. AWS S3 bucket* misconfiguration, firewall misconfiguration), 
• social engineering attacks (such as phishing attacks),
• weak passwords, 
• theft or loss of devices.

Often confused with data breaches, data leaks are likely to lead to one. Data leaks can simplify cybercriminals’ access to data necessary for launching an attack and serve as an initial stage of a cybercrime. It is noteworthy that, as per the IBM Cost of Data Breach 2022 and 2024 reports, data breaches with stolen or lost credentials (i.e. data leaks) require almost 300 days to identify harder to identify and cost USD 150,000 more than an average one.A financial loss generally accounts for $4.81 million per breach. Data leaks and breaches can be caused by insufficient cybersecurity of a business partner. As indicated in the IBM Cost of a Data Breach reports of 2023 and 2024, supply chain breaches accounted for one in five data breaches. They add more than USD 220,000 in cost and take 26 days longer to identify and resolve than the global average.

Data leaks can be the final phase of a cybercrime’s lifecycle as well: confidential data is often sold or posted on the dark web, raising the chances of further attacks.

Sensitive data that can be exposed includes: 

• Personally identifiable information (PII): e.g. names, phone numbers, addresses, social security numbers and emails;
• Financial data: e.g. credit card numbers, tax information;
• Account credentials: usernames, passwords and email addresses;
• Government or business information: records of internal communications and meeting notes, performance metrics, HR data and roadmaps;
• Trade secrets and intellectual property (IP): classified research, patents, project blueprints, testing materials, documentation related to discontinued or incomplete products, proprietary software, etc.;
• Medical information.

With human error being a primary factor of data leaks, not only overlooked digital vulnerabilities but also lack of cyber hygiene among staff poses a major threat to the cybersecurity of the entity as employees can easily become victims of a phishing attack, which can lead to exposure of confidential data, including the aforementioned sensitive information. According to the 2024 Data Breach Investigations Report, 68% of data breaches include a human element (social engineering attacks, errors, privilege misuse), stolen credentials were used in about 24% of breaches, and nearly 12% of incidents were caused by phishing attacks.

The Spam and Phishing report of 2022 by Kaspersky, a Russian cybersecurity company, showed that 9% of Africans (including corporate users) faced a phishing attack (attacks were stopped by the company’s anti-phishing system). In South Africa, 10% of individuals reported having been affected by phishing attacks, in Kenya – 8% and in Nigeria – 7%.

At the same time, the lack of cybersecurity personnel exacerbates the risks: as per the KPMG Africa Cyber Security Outlook 2022, worldwide an estimated 3 million cybersecurity job positions were unfilled and nearly 2/3 of studied African organisations faced difficulties with recruiting qualified cybersecurity professionals. In the public sector less than one third (29%) of all organisations have enough cybersecurity resources. According to the Serianu report, an estimated number of certified professionals stood at 20,000 in 2022. 

Another common shortcoming is managing cybersecurity regarding primarily data breaches, whilst an approach taking data leakages into account can tackle the root cause that leads to data breaches (i.e. leaked sensitive information).

According to the Africa Cybersecurity Outlook of 2022, data leakages (including personal information) ranked 3rd (with a 16% share) among the cyberattacks most commonly faced by African companies. In 2023 and 2024, data breaches became the most common consequence of a cyberattack for an organization with 61% share.  The first place in the ranking was occupied by business email compromise (26%) which can also be caused by data leaks. In 2023, the number of breached accounts in Africa slightly decreased from 1 million to 980,000. 

In 2022, data leakage was listed among the top three cyberthreats in Eastern, Southern and Western Africa.

Since many data leakages occur due to misconfiguration issues, consistently securing a cloud or a bucket that hosts all data and double-checking its access settings is essential. For instance, in the case of AWS S3 Buckets, they should be made private and password protected.

Educating non-security staff about cyber hygiene would also significantly contribute to mitigating risks of data leakage. Furthermore, developing comprehensive data privacy and protection regulation and standards would mitigate the risks of government data leaks, simplify case resolution in this area and ensure accountability.

Solutions

Measures necessary to prevent data leaks include:

• identifying and categorising all sensitive data;
• adopting a zero-trust strategy;
• simplifying access permissions;
• using multi-factor authentication and a password manager;
• encrypting all data;
• evaluating vendors and business partners cybersecurity risks;
• monitoring dark web forums and cybercriminal marketplaces.

Since many data leakages occur due to misconfiguration issues, consistently securing a cloud or a bucket that hosts all data and double-checking its access settings is essential. For instance, in the case of AWS S3 Buckets, they should be made private and password protected.

Educating non-security staff about cyber hygiene would also significantly contribute to mitigating risks of data leakage. Security measures to avoid becoming a victim of phishing attacks are the following:

• Opening emails and links only from legitimate and trustworthy senders, bewaring of phishing emails;
• Avoiding browsing suspicious websites and checking the URL links of questionable websites for mistakes (like a 0 instead of O, 1 instead of l, etc.);
• Installing security software;
• Downloading applications only from legitimate sources;
• Using different passwords.

There are also full Data Leakage Prevention solutions (e.g. the one provided by RusHighTechExport) that allow to control information flows in public and private structures. It helps to counteract information leaks by tracking all the actions of employees on work computers, namely, control of external messages of an employee (mail, instant messengers, video conferences), control of operations with files on the workstation, database operations control, monitoring the efficiency of working time at the computer.

Furthermore, developing comprehensive data privacy and protection regulation and standards would mitigate the risks of government data leaks, simplify resolving cases in this area and ensure accountability.

Authors:

Olesya Kalashnik

Daria Sukhova

Alexandra Yankova