When we think about data breaches, we think of a hacker sitting in a dark basement, hacking away at a firewall. In reality, most breaches are caused by human error. The sources for this statement are many and varied, but fairly consistent:

• Information Commissioner’s Office Data security incident trends (March 2018);
• Office of the Australian Information Commissioner Quarterly Statistics Report: January 2018 – March 2018;
• Julian Dutton ‘4 of the 5 top causes of data breaches are because of human or process error’ IT Governance (30 January 2018);
• Will R Daugherty ‘Deeper Dive: Human Error is to Blame for Most Breaches’ Data Privacy Monitor (25 April 2016);
• Tony Pepper ‘The people problem: How to manage the human factor to shore up security’ SC Media UK (25 May 2016).

Human error can include:

• weak passwords
• failure to recognise a cyber-attack, e.g. phishing
• not installing updates of software
• ‘people hacking’ or social engineering (when an identity thief successfully tricks a person to reveal information such as login details)
• accidental loss or disclosure of information
• not following IG policies and procedures

This means that even organisations with strong information security infrastructure remain vulnerable to data breaches if they fail to train their people.