The News: Multinational sportswear giant Nike is currently investigating a massive data breach after a hacking group known as “World Leaks” published 1.4 terabytes of internal documents on the dark web. The leak, which contains over 188,000 files, does not appear to involve customer credit cards or employee passwords. Instead, it hit something arguably more valuable: the company’s “brain.” The stolen data includes technical schematics, product designs, manufacturing evaluations, and supply chain logistics—the exact blueprints used to create their products.
The Expert Take: For the small business owner, this is a wake-up call regarding the NIST CSF 2.0 “Identify” (ID) function—specifically Asset Management (ID.AM) and Data Security (PR.DS). We often focus so much on protecting “Privacy Data” (like emails) that we forget to protect “Proprietary Data” (like your “secret sauce,” your vendor lists, or your unique business processes). As Nike is discovering, if an attacker steals your blueprints, they don’t need to hold your systems for ransom—they can simply sell your hard work to your competitors or to counterfeiters.
3 Privacy Lessons for Your Business:
- Blueprints are the Real Prize: If your business has a unique way of doing things, a specific set of vendor contacts, or custom designs, that info is a primary target. Hackers aren’t just looking for money; they are looking for “intellectual capital” they can flip for a profit on the dark web.
- The Supply Chain is Your Weakest Link: Initial reports suggest the Nike breach may have originated through a third-party vendor or supply chain partner. For an SMB, this means your security is only as strong as the smallest vendor who has access to your internal folders.
- Encryption for “Rest” and “Motion”: It isn’t enough to have a password on your computer. Your most sensitive business files should be encrypted so that even if a hacker manages to download them, they cannot actually open or read the contents without a specific key.
How to Protect Your Clients (and Your Business) Today:
- Identify Your “Crown Jewels”: Sit down and ask: “If a competitor saw one specific folder in my business, which one would hurt me the most?” Once you identify those “Crown Jewels,” move them to a separate, highly restricted storage area with extra security.
- Audit Third-Party Access: Review which vendors, freelancers, or contractors have access to your internal files (Dropbox, Sharepoint, etc.). If a project ended six months ago, revoke their access immediately.
- Label Your Data: Start a simple habit of marking internal documents as “Confidential” or “Proprietary.” Not only does this help employees handle data correctly, but it also provides a stronger legal standing if you ever have to pursue a case regarding stolen trade secrets.
Original reporting via: The National CIO Review and Infosecurity Magazine