After a Cyber Attack the Details Matter

So you have been hacked and the hackers stole your customers’ data. You try to do the right thing and notify them. By email. Because that might be the only address you have for them.

But many times that email never makes to your customer. Blocked by the customer’s email service provider or spam filter.

Are YOU now liable for failing to notify your customer? Ouch!

Bulk emails will be treated with suspicion if the do get delivered to to your customer’s inbox, so what should you do?

Even if the customer no longer uses your product, has unsubscribed from your email list or has black holed your company’s emails, you still need to notify them.

The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) last week released best practices recommendations for sender organizations on securely delivering mandated emails. You need to read this; it is a real page turner.

The number one thing to do is to plan in advance. Equifax tried doing the other way and it was a disaster.

Some of their tips include making sure that you have all of the email security features (SPF, DMARC, DKIM) enabled.

Send it from a trusted domain. Equifax created a new domain for the breach. New equates to malicious in email filters’ minds – especially if that new domain is sending out boatloads of emails – all of which go in the garbage.

Make the subject line obvious that it is not a piece of marketing email.

Keep the body as simple as possible with no marketing links.

These are just some of their recommendations. Your compliance or legal team needs to be well versed in the do’s and don’ts.

If you do not already have a plan, now is the time to create one.

by