Disney made the strategic decision to ditch Slack and transition to Microsoft Teams as its primary internal communication platform. This move comes as part of Disney’s broader efforts to enhance data security and minimise the risks posed by popular but potentially vulnerable platforms like Slack. Microsoft Teams offers end-to-end encryption and more advanced security measures, which are now seen as critical for safeguarding sensitive internal communications
What happened?
In July 2024, Disney suffered a major data breach that exposed over 1.1 terabytes (TB) of confidential data, primarily from its internal Slack communication channels. The breach was orchestrated by a hacktivist group known as NullBulge, which managed to gain access to nearly 10,000 Slack channels. The stolen data included unreleased projects, raw images, internal code, login credentials, and links to internal systems.
Disney has not yet released an official root cause, and as such, the internet is rife with speculation. One theory suggests that the breach started when a Disney software development manager downloaded a Trojan horse malware, disguised as a mod for BeamNG, a popular game about vehicle physics. The malicious software was installed on the employee’s personal computer, which had access to Disney’s Slack channels. Once installed, the hackers were able to infiltrate Disney's internal communications.
Another theory points to the use of an "Information Stealer" malware, which may have been bundled with the same game mod. In this scenario, the attackers gained access through the employee's personal gaming computer, which was also being used to access a password vault that did not require multi-factor authentication. This gave the hackers full access to Disney’s internal systems once the employee logged in.
What does it mean for your organisation?
This incident serves as a reminder that even high-profile companies like Disney are not immune to data breaches. Regardless of the exact method, this breach underscores the fact that employees can often be the weakest link in the security chain. In addition to the risks posed by mixing personal and professional use on the same device, this case also highlights the dangers of inadequate security practices, such as not enforcing multi-factor authentication. As a result, even the most secure platforms can be compromised if basic security measures are overlooked.
Vulnerabilities in Popular Platforms: While widely used, platforms like Slack or Teams can become prime targets for attacks. It is crucial to assess the security configurations of these tools and ensure that sensitive internal communications are protected with encryption and multi-factor authentication (MFA). Regular security audits and updates should be part of the organisation's routine.
Manage Insider Threats: The potential involvement of an insider in the Disney breach emphasise the need to monitor internal risks. Ensure that access to data is limited to what is necessary and regularly reviewed. Implement policies that track and report unusual employee behaviour to mitigate insider threats.
Effective Data Protection Policies: Organisations must ensure that proper data protection policies are in place, covering how internal communications are managed and secured. Regularly update these policies to address emerging threats and provide staff training to raise awareness of potential risks.
Below are some practical steps your organisation can take to mitigate these risks:
Strengthen Security Controls: Implement stronger access controls, such as MFA and role-based access, to limit who can view the data. Ensure that these controls are enforced for all digital platforms used within the company.
Limit Personal Device Usage: If employees must use personal devices for work, ensure these devices meet the organisations security standards and limit the type of access they have to sensitive systems.
Data Minimisation and Retention Policies: Keep only the necessary data for the shortest period required. Regularly review and purge data to minimise the impact of a potential breach.
Ongoing Security Training: Make cybersecurity training an ongoing effort, focusing on recognising phishing attempts, avoiding suspicious downloads, and understanding the importance of MFA and secure password practices.
The takeaway?
No platform is entirely safe from cyberattacks, but proactively managing internal security, limiting access, and ensuring strong data protection policies are in place will significantly reduce your organisation’s exposure to such risks.
Tales from the coalface
Each month, we examine pressing Data Protection issues encountered by our clients. This month we looked at queries associated with implementing an effective third-party vendor management programme. As the reliance on external vendors grows, ensuring these partnerships uphold data protection standards is critical to avoiding compliance risks.
Assessing Third-Party Vendor Management Practices
For many organisations, third-party vendors play a crucial role in day-to-day operations. However, with this outsourcing comes the risk that vendors may not apply the same level of rigour in safeguarding personal data. One of our clients identified the need to evaluate their vendor management processes after a routine audit highlighted potential vulnerabilities in how third-party vendors handled personal data. The company discovered that they lacked consistent oversight over how vendors managed personal data, leading to possible gaps in compliance with GDPR and other relevant regulations. They realised that they lacked consistent oversight of vendor data practices, creating possible compliance risks with GDPR and other regulations.
Key Challenges in Third-Party Vendor Management
Lack of Data Protection Standards Across Vendors: Vendors varied in their data protection capabilities, from sophisticated security practices to minimal or outdated safeguards. This inconsistency made it difficult for the organisation to ensure all personal data was adequately protected across its vendor network.
Inadequate Vendor Contracts: Many vendor contracts did not include explicit clauses regarding data protection, leaving the organisation exposed to potential non-compliance. Without clear obligations on data handling and breach reporting, it would be hard to enforce accountability in the event of a data incident.
Vendor Risk Assessments: The organisation had no formal process to assess the risks vendors posed to data protection. As a result, they could not categorise vendors based on their data processing activities and the associated risks, increasing the likelihood of data breaches.
Data Breach Response and Notification: There was limited clarity around how vendors should handle data breaches, particularly concerning notification timelines and incident management. This ambiguity raised concerns about the company's ability to respond to potential breaches effectively.
Improving Vendor Management Practices for Data Protection
Following the audit, the organisation embarked on a comprehensive review of its vendor management programme to address these issues. Below are some of the best practices they implemented:
Establishing a Vendor Risk Assessment Framework: The organisation developed a formal risk assessment framework to evaluate each vendor’s data protection practices. Vendors were categorised based on the type of personal data they handled and the associated risks. This allowed the company to focus on high-risk vendors first and ensure they adhered to the required data protection measures.
Implementing Data Processing Agreements (DPAs): All vendor contracts were reviewed and updated to include Data Processing Agreements (DPAs). These agreements specified how vendors must handle personal data, outlining their obligations to protect data, report breaches, and ensure compliance with GDPR. Clear expectations and consequences were set for vendors that failed to meet these standards.
Vendor Audits and Due Diligence: The organisation introduced regular audits of their third-party vendors, ensuring continuous compliance with data protection requirements. Vendors were required to demonstrate that they had the necessary technical and organisational security measures in place to safeguard personal data. Audits were scheduled based on the risk level assigned during the assessment process.
Breach Response Procedures: Vendors were instructed to align their breach response procedures with the company’s own incident management policies. This included clear notification timelines in the event of a breach, ensuring the organisation was informed promptly and could take appropriate action to mitigate any impact.
Results and Lessons Learned
The organisation saw marked improvements in its overall data protection posture after implementing these changes. By categorising vendors and tailoring data protection requirements to each risk level, the company was able to better allocate resources and ensure that high-risk vendors were meeting the compliance standards. Moreover, with more robust contracts and continuous vendor assessments, they reduced their vulnerability to data breaches and improved their regulatory compliance. Managing third-party vendors in the context of data protection is an ongoing process that requires careful assessment, clear contracts, and regular monitoring. Organisations must ensure that all vendors handling personal data comply with relevant laws and have adequate safeguards in place. By taking a proactive approach, companies can significantly reduce their risk exposure while maintaining strong partnerships with external service providers.
If your organisation is facing challenges in third-party vendor management or needs support with data protection compliance, get in touch with Ambit Compliance. Our team is here to provide expert guidance to help safeguard your data across your vendor network.
Contributors to this newsletter:
Gillian Traynor and Dwayne Morgan
