The public is extremely sceptical about how their data is used. A survey by Pew Research Centre as far back as Oct 2023 found that, among Americans, 71% said that they were very or somewhat concerned about how the government uses the data it collects about them.

This had increased from 64% in 2019. I would speculate that the figure in the USA is even higher now since the introduction of DOGE (the Department of Government Efficiency). The figures would be roughly similar for Scotland and the UK.

Any data breach results in the public becoming even more cynical about the ability of governments and corporations to properly manage and protect their personal information. This is bad for democracy and bad for corporate reputation. Anything which decreases the electorate’s faith in government inevitably opens the door for non-democratic actors.

Global problem

The responsible protection of  vast quantities of personal information (names, addresses, phone numbers, credit card details, tax returns, medical history etc) which is held by organisations has now become a global problem which affects governments and corporations worldwide and has financial and reputational consequences.

A quick glance at international media coverage on a single day in November 2025 (Friday 14^th) found this selection of headlines:

• Afghan data breach was ‘farrago of errors and missteps’ that could happen again, say MPs (Daily Mail, UK)
• Labour’s BritCard digital ID nightmare shows how much they disrespect UK veterans (Express, UK) 
• Insurers pay out £200m to support businesses hit by cyber attacks (Daily Mail, UK)
• AT&T Data Breach Settlement: Who Is Eligible and How to Claim $7,500 (Newsweek, USA) 
• Genea patients want IVF giant held to account as cybersecurity expert raises ongoing concerns (ABC, Australia) 

Almost half of UK companies reported a data breach in the past 12 months

The UK Government’s survey of Cyber Security breaches, published in June 2025, reported that 43% of companies reported some kind of data breach or attack in the previous 12 months.

This isn’t surprising if you take just a cursory look at the apps on your phone. We all now have a mixture of apps which cover health, finance, utilities, fitness, music, parking, podcasts, shopping, travel, concerts,events, taxis and Ubers. All of these companies hold our personal data to varying degrees.

In fact, when I checked my own phone, one of the scary realisations was that I have local taxi apps for multiple countries around the world and I have no idea how responsible those people are when it comes to storing my data.

Anyway, back to the subject of this article.

Six years ago (2019) IPSOS published a survey which gave some perspective on the size and volume of data breaches: the Capital One Financial breach affected 106 million credit card customers, the Marriot International hotel chain breach exposed 500 million customers, and the most recent M&S breach cost the company £30 million immediately in lost profits, plus an estimated £15million per week for each week they were off-line to customers – and that’s without looking at share values.

Worsening Situation

Gartner thinks that the situation will get much worse because of the rapid and unregulated adoption of AI.

In an opinion piece published in February 2025, they identified the cross-border GenAI misuse as the source of 40% of all AI data breaches by 2027. They believe that “the breaches will be caused by the improper use of generative AI (GenAI) across borders” and that the swift adoption of GenAI technologies “has outpaced the development of data governance and security measures, raising concerns about data localization due to the centralized computing power required to support these technologies”.

Preparation

So, let’s be honest, if you hold data, a data breach is inevitable. It begs the question – how prepared are you?

1. The first rule of crisis is to identify the threat at the earliest possible opportunity (i.e. when you start collecting data) and then put structures in place which will help you deal with a breach when it happens. The National Cyber Security Centre’s crisis playbook and the Scottish Government’s cyber incident response tool kit apply here.
2. In the incredibly fast-paced world of technology, the second rule must be that companies and the public sector continually monitor potential new threats to the security of the data that they hold, and review their protection systems on a quarterly basis.
3. The third rule is that every data controller has a fully operational crisis media plan so that they can swiftly address any breaches that arise with a comprehensive and compelling response that enhances or restores trust in the organisation.

Reputational damage

The biggest casualty in crisis is reputation.

Those who previously trusted you now have doubt. Those who invested in you are no longer sure of the safety of that investment. Customers who buy from you now question how much you really cared about them.

Recommended reading

• Surge in Darknet Activity Ahead of 2024 US Election
• Report: Phishing Clicks Surged 190% in 2024
• How Worried Are Brits About AI-Fuelled Phishing?
  

Every journalist covering a data breach story wants answers to 6 questions: who, where, what, when, why and how. The faster you can answer these questions, with credibility and verified data, the less reputational damage you will do to your company or sector.

The management of personal data causes great anxiety to those who provide the information. Data controllers have an obligation to their customers to not only keep their data safe, but to have detailed crisis media plans ready so that they can communicate with those customers and assure them that they have been acting in good faith at all times and are, indeed, adopting a responsible attitude to the management and care of their personal details.

Reputation takes years to build, but only a matter of seconds to lose. A data breach, of whatever magnitude, is inevitable – how you emerge from it depends on your level of preparation.