Accountancy software maker Sage has revealed it’s been hit by a data breach affecting a “small number” of its UK and Ireland business customers.
Shares in the Newcastle-based firm slumped by over 3% on Monday morning after Sage posted a brief note to its website.
It explained:
“We believe there has been some unauthorised access using an internal login to the data of a small number of our UK customers so we are working closely with the authorities to investigate the situation.
Our customers are always our first priority so we are communicating directly with those who may be affected and giving guidance on measures they can take to protect their security.”
The firm also posted a helpline number and email address for any customers wanting to find out more.
Although Sage said only a small number of customers were affected, the figure could stand at as many as 280, according to numerous reports on the incident.
The 1bn+ revenue business is estimated to have over six million customers and offices in 23 countries worldwide.
Eduard Meelhuysen, EMEA vice president at Netskope, argued the case highlights the dangers of ‘insider’ threats.
“Wherever possible, organizations should use policy and employee training to coach staff towards safe courses of action and secure cloud apps without impacting productivity. However, surgical visibility and control, and robust data analytics are also crucially important as they will help differentiate between employees and bad actors,” he added.
“Unusual behavior or abnormal usage patterns will alert security teams to suspicious circumstances, but only if they have the necessary tools in place for visibility and control of employee behaviour, such as a Cloud Access Security Broker (CASB), and they know what ‘normal’ looks like. Watching out for app access from employees who have had credentials compromised in a previous data breach is also key in order to prevent cyber criminals from infiltrating the network by posing as an employee like a wolf in sheep’s clothing.”
A recent report by Splunk and IDC found that, although over 40% of firms are worried about the prospect of a data breach, just 12% reported that the threat of a malicious insider was a high concern for their business.