Analysing a data breach and its impact on an organisation

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which response best analyses a data breach?

A Describe the cause, the data and people affected, and the impact on the organisation

B State only that the organisation was hacked and apologise to customers

2. A staff member emails a customer list to the wrong person. Which statement describes the CAUSE of the breach?

A Human error: an employee sent data to an unintended recipient

B Customers lost trust and stopped buying from the company

3. Which statement describes the DATA AFFECTED by a breach?

A Names, addresses and credit card numbers of 5000 customers were exposed

B The company had to pay a large fine to the regulator

4. Which is an impact on OPERATIONS?

A Newspapers reported the breach and the brand image suffered

B Systems were shut down for three days, so orders could not be processed

5. Which is a FINANCIAL impact of a breach?

A Customers said they no longer trusted the organisation with their data

B The organisation paid for forensic investigators and compensation to customers

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Cause: phishing email led staff to share login details		AIt ignores the impact on finances, reputation and legal standing. A system running again does not mean there was no impact.
2Data affected: 40,000 customer names, addresses and card numbers		BIt ignores legal standing. A breach of personal information can breach the Privacy Act and require notification and penalties.
3An impact on finances: the organisation pays for investigation, fines and compensation		CImpact (reputation): 15% of customers closed accounts after the news report
4An impact on reputation: customers lose trust and leave the organisation		DIdentifies which data and which people were affected by the breach
5Analysis: Data was leaked. Impact: none, because the system is working again.		EDescribes how the breach happened, which is the first part of a breach impact analysis
6Impact (legal): the breach only affects the IT department, so no laws apply		FImpact (finances): $2.5M in recovery costs, fines and customer compensation

Definitions

Breach impact analysis

Fill in the Blanks

Complete each line of code by filling in the missing parts.

breach._____ ← "phishing email"

breach.____ ← ["names", "addresses"]

________ impact IN breach.impacts DISPLAY impact END FOR

breach.impact.__________ ← "lost trust"

IF breach.sensitive = TRUE THEN breach.impact._____ ← "notify OAIC" END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Breach: customer database leak

B Cause: phishing email

C Impact: names, emails, passwords

D Impact: loss of reputation

Question 2

A Cause: $50,000 in lost sales

B Data: 2,000 patient records

C Impact: clinic offline 3 days

D Legal: notify the OAIC

Question 3

A Cause: stolen staff laptop

B Data: no data was affected

C People: 800 clients

D Impact: reputation damaged

Question 4

A Cause: ransomware attack

B Data: sales and customer files

C Operations: orders halted

D Reputation: lost sales, fines

Question 5

A Cause: weak admin password

B Data: staff tax file numbers

C Legal: no notification needed

D Harm: identity theft risk

Answer Key

Analysing a data breach and its impact on an organisation

Section A: Quick Questions

A — Describe the cause, the data and people affected, and the impact on the organisation

A — Human error: an employee sent data to an unintended recipient

A — Names, addresses and credit card numbers of 5000 customers were exposed

B — Systems were shut down for three days, so orders could not be processed

B — The organisation paid for forensic investigators and compensation to customers

Section B: Match the Pairs

Cause: phishing email led staff to share login details → Describes how the breach happened, which is the first part of a breach impact analysis

Data affected: 40,000 customer names, addresses and card numbers → Identifies which data and which people were affected by the breach

An impact on finances: the organisation pays for investigation, fines and compensation → Impact (finances): $2.5M in recovery costs, fines and customer compensation

An impact on reputation: customers lose trust and leave the organisation → Impact (reputation): 15% of customers closed accounts after the news report

Analysis: Data was leaked. Impact: none, because the system is working again. → It ignores the impact on finances, reputation and legal standing. A system running again does not mean there was no impact.

Impact (legal): the breach only affects the IT department, so no laws apply → It ignores legal standing. A breach of personal information can breach the Privacy Act and require notification and penalties.

Section C: Definitions

Breach impact analysis — Describing the cause of a breach, which data and people were affected, and the impact on operations, finances, reputation and legal standing.

Section D: Fill in the Blanks

breach.cause ← "phishing email"

breach.data ← ["names", "addresses"]

FOR EACH impact IN breach.impacts
    DISPLAY impact
END FOR

breach.impact.reputation ← "lost trust"

IF breach.sensitive = TRUE THEN
    breach.impact.legal ← "notify OAIC"
END IF

Section E: Spot the Error

C — Names, emails and passwords are the data affected, not an impact. The line should be labelled 'Data:'.

A — Lost sales are a financial impact, not the cause of the breach. The cause should describe how it happened, such as an unpatched server flaw.

B — This contradicts the rest of the report. A stolen laptop holding unencrypted client files means client data was affected. The line should name that data.

D — Lost sales and fines are financial impacts. The line should be labelled 'Finance:', not 'Reputation:'.

C — Tax file numbers create a risk of serious harm, so this is an eligible data breach. The organisation must notify the OAIC and the affected individuals.