The short answer
Big breaches have ordinary causes: databases open to the internet, reused or stolen passwords without multi-factor authentication, unpatched systems, over-privileged accounts, weak supplier oversight and slow detection. Four lessons apply at every size:
- Keep lessUnkept data cannot be stolen.
- Close the doorsExposed systems, weak identities.
- Detect fastSpeed decides the damage.
- Respond wellIncluding legal reporting.
Drawn from patterns across many public breaches, with no unverifiable figures.
1. Data you do not keep cannot be stolen
Many big breaches exposed records nobody needed: former customers, old applicants, duplicate exports, test copies of production data. Every copy needs protecting, and large central datasets attract attackers; the NDPA's data minimisation and storage limitation principles point the same way. So: inventory where personal and sensitive data lives (spreadsheets, file shares, backups, SaaS); delete when retention periods expire, subject to legal requirements; mask real personal data in test and development; encrypt at rest and in transit.
2. Exposed systems and weak identities are the usual way in
Typical ways in: public cloud storage or databases, remote access without MFA, unpatched internet-facing software, phished or reused credentials. Baseline controls such as the NIST Cybersecurity Framework and CISA's ransomware guidance cover most: automatic patching, secure configuration, strong authentication, perimeter defences, secure cloud use, least privilege.
MFA everywhere
Email, remote access, cloud consoles and administrator accounts first.
Patch the edge first
Internet-facing systems fastest; retire software without security updates.
Review cloud permissions
Regularly; public access should be deliberate and rare.
Least privilege
Only the access each role needs; separate administrator accounts.
Include suppliers
Security commitments in contracts; vendor access removed when no longer needed.
3. Detection speed decides how bad it gets
Attackers often stayed inside for weeks or months, taking more the longer they stayed. Deploy monitored endpoint detection and response (EDR vs antivirus); centralise identity, email, firewall and cloud logs and keep them long enough to investigate; alert on mass downloads, new administrator accounts and unexpected login locations. CISA's ransomware guidance recommends logging and alerting, network segmentation, least privilege and multiple offline backups as core preventive measures.
4. Your response is part of your security
Slow response, poor communication and missed legal obligations do the most damage.
- Short response plan: who decides, investigates, communicates, calls counsel and insurers
- IT provider, counsel and insurer contacts kept off your systems
- Yearly tabletop exercise
- Offline or immutable backups, tested restores
Breach-readiness checklist
- We know where sensitive and personal data is stored.
- We delete data we no longer need, on a schedule.
- MFA is on for email, remote access, cloud and admin accounts.
- Internet-facing systems patched promptly; unsupported software retired.
- Cloud storage and database permissions reviewed this quarter.
- EDR is deployed and alerts are monitored.
- Key logs are collected and retained.
- Supplier access is documented and reviewed.
- Tested incident response plan and breach record log in place.
- Backups include an offline or immutable copy; restores tested.
Limitations and next step
No controls prevent every breach; the aim is harder attacks, sooner detection and less taken. Priorities depend on your data, systems and risk tolerance, so start with a risk assessment. Our cybersecurity services put these controls in place and monitor them, with 24/7 monitoring and support for managed-service clients. Unsure where you stand? Book a security assessment.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Commission (NDPA, GAID 2025 and breach reporting), Nigeria Data Protection Commission
- ngCERT, Nigeria's computer emergency response team, Federal Government of Nigeria
- Cybersecurity Framework, NIST
- #StopRansomware, CISA
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.