Talk Talk’s data breach resulted in the theft of personal details belonging to 157,000 customers.

The fine is the highest ever imposed by the ICO, with TalkTalk’s lack of cybersecurity cited for the amount.

The Information Commissioner, Elizabeth Denham, said that TalkTalk’s “failure to implement the most basic cybersecurity measures allowed hackers to penetrate systems with ease”.

While in the eyes of some the fine may seem high, it’s only £2.50 per impacted customer.

The ICO’s stance should act as a warning to others that it’s taking the safeguarding of data seriously.

As businesses continue to collect and store more sensitive information on customers, employees and partners, the regulator will use all its power to ensure firms are held accountable.

>See also: The cost of TalkTalk’s security breach has doubled to nearly £80 million

Yet, the TalkTalk breach can be examined further and there are key lessons all businesses should learn from.

1. The total cost of a data breach isn’t always obvious

While the £400,000 fine is substantial, it’s really just the tip of the iceberg in regards to how much the data breach actually cost.

There were so many other financial repercussions which, to some other firms, may have been fatal.

There was the 11% drop in share price, as well as the loss of 101,000 existing customers and potential future ones.

All in all, when remediation costs are included too, TalkTalk calculated that the breach cost it more than £80 million. That’s hardly pocket change.

2. Acquisitions and demergers affect cyber risk

When Carphone Warehouse purchased the UK subsidiary of Tiscali, the business was merged with TalkTalk which it also owned at the time. Following the data breach, the ICO’s investigation revealed that the hackers had gained access to the customer database through vulnerable webpages that had belonged to Tiscali.

When companies join or split, how the action impacts IT systems must be managed, regardless of how insignificant they may seem.

>See also: SQL injection: how to avoid the same fate as TalkTalk

Systems will have different parentage, which can impact how effective a cybersecurity solution or process is, leaving potential access points unguarded.

3. Patching and updating can mitigate some of the risks caused by ageing systems

It’s no great surprise that older systems are more vulnerable to cyberattacks than newer ones. Yet, some businesses continue to rely on aging systems without patching or updating them, which is simply making things even easier for cybercriminals.

The targeted Tiscali webpages had not been patched for three and a half years and the backend database was no longer supported by the supplier, when you consider the rapid pace of cyber threat evolution, that’s the equivalent of leaving the windows and doors open.

Businesses must ensure they are patching on a regular basis and setting aside time for major updates.

4. Warnings and red flags should be investigated

TalkTalk has and will continue to face scrutiny for its handling of the debacle, but one of the biggest criticisms is that it did not investigate numerous warnings that something was wrong.

While it was the October 2015 data breach that made these particular headlines, TalkTalk customers had fallen victim to scams due to a previous breach.

The regulator’s investigation found there had been two SQL injection attacks in the three months prior but TalkTalk was not monitoring those particular webpages.

Whether the company ignored the warnings or was simply ignorant, businesses should investigate any signs that an issue exists.

>See also: The chickens have come home to roost: TalkTalk fined

This also includes red flags generated by cybersecurity systems. Almost a third of companies suffer from alert fatigue, due to their general frequency and numerous false positives, and do not investigate.

5. Communication plans are essential

How a company communicates a data breach is vital in mitigating the potential damage to reputation.

If customer data has been compromised, they need to be made aware of it, with the need even more pressing if bank details are taken.

To ensure all stakeholders are reassured that the situation is being handled, firms must have a communication plan, including draft email, letter and script templates, in place so they can be issued immediately.

Unfortunately TalkTalk’s initial responses fanned the flames due in part to lack of preparation as well as slow identification of the total data loss.

While companies must be proactive with their communications, they must also have the necessary resources to deal with customers calling in.

TalkTalk customers faced long holding times when ringing to find out more information, compounding anger further.

6. EU GDPR is looming

The ICO’s fine is a record amount but TalkTalk is fortunate that the breach took place before the EU GDPR comes into force in May 2018.

The new regulation will see potential fines increase to four percent of global turnover or €20 million, whichever is higher, meaning TalkTalk would have faced an even more significant amount.

>See also: The 2016 cyber security roadmap

Furthermore, any company that experiences data loss, regardless of whether it’s their fault or a third parties’, will have 72 hours to disclose it to the regulators and data subjects “without delay”, so being able to investigate data transfers and monitor cloud use will become essential.

7. Cybersecurity is a boardroom issue

If a company were to take only one lesson away from TalkTalk’s breach, it’s that data is now the crown jewels of any business.

Not only will it help drive sales and growth, but mishandling it can lead to severe fines and even closure.

It needs to be treated with the utmost respect and that means understanding that cybersecurity is now a boardroom discussion.

For too long it has been considered the remit of IT but, with so many areas where a business can become vulnerable, it must now be an enterprise-wide endeavour.

Sourced by Nigel Hawthorn, chief European spokesperson at Skyhigh Networks