The News: The Minnesota Department of Human Services (DHS) recently announced a significant data breach affecting over 300,000 individuals. The breach occurred when an employee’s email account was compromised, allowing unauthorized access to a massive trove of sensitive information, including names, addresses, and dates of birth. While there is no evidence yet that the data has been misused, the department is now facing a massive logistical and legal hurdle to notify victims and secure their systems.
The Expert Take: For the small business owner, this story highlights a major shift in the NIST CSF 2.0 “Identify” (ID) function—specifically Data Governance (ID.GV). You are legally responsible for the data you keep, regardless of how you lost it.
Many SMBs hold onto “legacy data”—old client files, past employee records, or unneeded contact lists—without realizing that every single row in a spreadsheet is a potential liability. In this case, a single compromised email account acted as a “skeleton key” to 300,000 lives. If your business stores Social Security numbers, health info, or even just detailed customer profiles, you are sitting on a “data bomb” that only needs one weak password to go off.
3 Privacy Lessons for Your Business:
- The “Need to Know” Rule: Does every employee in your office need access to your full customer database? Use Access Control to ensure staff can only see the information required to do their specific job.
- Email is Not a Vault: Many businesses “store” sensitive info by leaving it in their inbox or “Sent” folders. If your email is hacked, your entire history is exposed. Use a secure, encrypted document management system instead.
- The “Purge” Policy: If you don’t need the data, don’t keep it. Identify old records that are no longer required for tax or legal purposes and delete them securely.
How to Protect Your Clients (and Your Business) Today:
- Audit Your Permissions: Review your cloud storage (Google Drive, OneDrive, Dropbox). Check who has “Editor” or “Owner” access to sensitive folders and trim it down to the essentials.
- Enable MFA on Email: As seen in this breach, the email account was the point of entry. Multi-Factor Authentication on every employee’s inbox is your strongest defense against this specific type of disaster.
- Create a Data Inventory: Map out where your most sensitive data lives. Is it on a local server? In a cloud app? In a physical filing cabinet? Knowing where it is (the Identify function) is the first step to protecting it.
Original reporting via: KSTP News Minnesota