Lesson from Casio’s Data Breach: Why Database Security Still a Major Challenge for Businesses?

Database security is difficult because of the large volume of attacks, zero-day exploits, human errors, and the need for continual management of security tools.

On October 12, Japanese electronics maker Casio was the victim of a data breach. A bad actor obtained files containing sensitive information from 91,921 customers in Japan and 35,049 users from 148 other countries from which the company operates.

The compromised database belonged to a company’s educational platform known as ClassPad. Therefore, those affected were both individuals and educational institutions.

Some of the files that hackers stole amid the breach contained sensitive information such as names, email addresses, payment methods, purchase information, and regions of residence.

Cybercriminals were able to breach the company due to the weakness in its database, later discovered within the development environment.

The company is currently investigating the attack, strengthening the security of its databases, and dealing with the aftermath of the breach.

For Casio, this marks the second major data breach of this year. In August 2023, the hacker dubbed Thrax stole and leaked 1.2 million pieces of customer data. Casio’s data breach is one of many that happened this year.

The truth is, any company can be the victim of a data breach — regardless of its IT resources, size, or whether it already has been the victim of an attack. Nothing makes a business 100% immune to potential data compromise.

Aware of the possible reputational and financial consequences of a data breach, businesses already invest a lot in security to protect one of their most important assets — data. However, the number of compromised databases remains high. Why is database security still a major struggle for companies nowadays?

****Human Errors at the Heart of Most Attacks****

To compromise the database as it happened to Casio, the hacker needs to gain initial access. In their case, the mistake happened due to operational errors within the development environment.

That oversight allowed hackers to get into the database of the educational platform.

For most companies, the culprit of a data breach is a human mistake. It’s estimated that 95% of data breaches can be attributed to it. That is, nine out of ten data breaches happen because of human error.

Some common ways database breaches result from human errors are:

• Poor password practices — weak and reused credentials or password sharing
• Deleting or corrupting the records — by accident
• Falling for phishing schemes — clicking on the link or sending credentials to the threat actor

General workforce and phishing schemes are usually highlighted when the topic of human errors and data breaches is discussed. However, anyone can make a mistake, from developers and security experts to those working in finance or marketing.

****Large Volumes of Cyber Attacks that Compromise Data****

Over the last couple of years, businesses have been up against more data breach attempts than ever before. As mentioned, Casio had been the victim of two major data breaches within the last couple of months alone.

With a larger volume of cyberattacks that attempt to compromise data, there is a higher chance that a human mistake will result in stolen data. And that vulnerability that hasn’t yet been discovered by the company will be exploited in the attack.

We’ve already read about a lot of data breaches in the news. But keep in mind that these are only the highlights. Many hacking incidents and data compromises go unreported.

Not every company in every sector and every country has to disclose a breach. It depends on its severity and whether they have to notify the users that their personal data has been exposed in the breach.

Since not all companies disclose a breach, their users can be at greater risk of being a victim of further data theft, phishing attempts, and even identity fraud.

****Data Protection Seeks Continual Management****

As with any other cybersecurity system, database security processes and tools have to be continually managed and improved. This is another major factor that makes data security challenging for companies — where should they even start?

For example, this could mean a company has to continually update access to protect the databases of a business.

Suppose an employee changes their role within the company or is no longer a part of the team. Their user access has to be revoked or changed to fit the new role as soon as possible.

Then, there are flaws within the software environment. Companies need to patch them up regularly to prevent databases from being accidentally exposed in an attack.

In Casio’s case, the network security settings within the development area have been disabled. This weakness, discovered too late, opened the doors to hackers.

****Shortage of IT Professionals****

Another factor that makes database security challenging is the lack of professionals within IT and cybersecurity who specialize in data security and cybersecurity. They regularly manage the security and keep the hacker far away from the databases.

Companies that have fewer professionals are at a heightened risk of errors because those who do stay in the company have to take up large workloads. There is also more pressure and stress within understaffed and overworked IT departments.

True, in this year, there has been a surge of layoffs within the tech industry. However, IT workers also leave their jobs due to stressful environments, insufficient compensation, and lack of opportunities to grow and develop within their roles.

****Database Security Is a Work in Progress****

One vulnerability within the database is enough for the hacker to compromise the data of hundreds or even billions of sensitive user records.

The severity of financial as well as reputational damage depends on the flaw that a hacker could have exploited and how skilled is the threat actor.

While there is no one ultimate solution for reducing the chance of a data breach to zero, what most companies can do is prioritize the protection of sensitive databases.

Also, they should continually strengthen database security — and seek vulnerabilities that could lead to data breaches, such as those that affected Casio this year.

1. Casio China Hacked, 150,000 user accounts leaked
2. Casio Electronics Taiwan Website Hacked by SaMuRai Hacker
3. Human Error: Casio ClassPad Data Breach Impacting 148 Countries
4. Sony Data Breach via MOVEit Vulnerability Affects Thousands in US
5. Okta Breach Linked to Employee’s Google Account, Affects 134 Customers