What tech startups can learn from major data breaches in Asia

As tech startups mushroom across Asia at an unprecedented rate, there is a need to make sure that they’re prepared for anything that comes their way.

You may have your app or website running on a scalable cloud server. You may have a sound plan of action and sales projections you’re confident you can make. You may even have a marketing strategy in place to make those sales a reality.

With all of that preparation for visitors and sales, are you also prepared to fight off hackers and data breaches? If you think your business is safe because it’s a startup, think again. According to a 2014 report from the Economist Intelligence Unit, approximately 40% of businesses in our part of the world say they have experienced “significant” financial losses at the hands of data systems being compromised.

Image from Cuneopost

To improve your information security and learn how to prevent data breaches, it is useful to discover how data breaches of the past could have been prevented. The following are 3 infamous data breaches that resulted in some of the highest amounts of stealing and sharing of customer data that Asia has ever seen. While many big companies across Asia have experienced data breaches in recent years, our list focuses exclusively on breaches that directly impacted citizens of Asian countries.

China Software Developer Network (CSDN)

What happened?

6 million user names, passwords and email addresses were hacked from a network of Chinese sites for finance, gaming, social networking and shopping, and the data was then published online. The data was mined by a hacker over a 12 month period during 2009 and 2010 and was then leaked online in December 2011. In addition to the leak of the sensitive user data in late 2011, the hacker acknowledged his shady activity in 2010 and claimed he had access to the database as early as April of that year.

According to a report in March 2012 by ZDNet, during their investigations, Beijing police found that four additional hackers were doing the same thing to the CSDN server. Almost three months passed between the time of the leak of the user data and the arrest of the primary suspect.

What can we learn from this?

Make sure all personally identifiable user data is stored on an encrypted server, and make sure your users are periodically changing their passwords. Once a server is hacked, it will likely be a target by potential hackers and copycats. In addition to encrypting your servers, always keep the server up-to-date.

Korea Credit Bureau (KCB)

What happened?

40% of South Korea’s population — about 20 million people — had all of their personally identifiable information and bank account information compromised by an inside job.  A consulting temp working in KCB was arrested for allegedly stealing the data from customers of 3 credit card firms and selling the data to telemarketing companies for millions. The managers from each of these companies were also later arrested.

In addition, the credit card firms were held responsible for covering any charges and financial losses incurred by its customers following the leak.

What can we learn from this?

KT Corp

Could these data breaches could have been prevented?