Put on your dancing shoes - or not!

I have been receiving emails about dance classes for the last few months, I don't remember signing up for them and anyone who knows me will testify to the fact that I have no sense of rhythm at all.

Anyway, somehow I have been added to this mailing list for dance classes. I started receiving emails about three months ago and on average I get three a week. On occasion I have had two a day. There is no method to unsubscribe from the emails. Having got bored with receiving the emails I decided to respond to an email by asking to be removed from the mailing list. I did this on two occasions a week apart. I didn't receive a reply. The other day another email pinged into my email inbox and I decided I needed to take direct action so I rang the telephone number shown. It went to an answerphone giving me details of the classes available (Was there no escape?).

I decided I would call back again later. Just after I put the phone down, a text came in - guess what - it was a text to tell me about dance classes from the number I had just called. I was furious. I rang the number again, this time it was answered. I explained that I was very angry that I was receiving these emails and to receive a text was just too much - I had not given her permission to send me marketing by text message. The response - "Well people call me all the time wanting to know the times of dance classes so I don't answer the phone and send them a text" - really, you don't think that sending emails and the answer phone message giving information about dance classes is enough, you decide to send spam texts as well. "Nobody else has complained" (that old chestnut).

I asked about the previous emails asking to be unsubscribed and she told me she hadn't received them. I asked her to remove me from her mailing list, so I gave her my email address and she searched, only to tell me it wasn't there. I said it must be, you are sending me three emails a week on average. "Oh no that isn't possible as that would mean you were on three lists". She rechecks and finds I am on her database and on three lists (big surprise!). She said she had been hacked about a month ago and the hacker must have put me on the lists (so a hacker breaks into her email account and adds my name to three of her mailing lists so she can send me emails about dance classes, what a helpful hacker!). She tells me she cannot delete me from her database, "it won't let me". I reinforce the fact I wish to be removed from the mailing lists and how she does it is not my problem, I say goodbye and hang up. A little while later another email comes in from her to tell me she has removed me from her mailing lists but she had to remove 10 other people to be able to do it.

What did I learn?
- the dance class provider is not registered with the ICO - potentially a £5k fine and criminal record from not being registered.
- the emails she is sending breach PECR (Privacy and Electronic Communication Regulations) by not having a means to easily unsubscribe.
- Failing to remove me from her mailing list on the two previous occasions is another PECR breach.
- Sending me an unsolicited marketing text is a data protection breach - The ICO has recently fined a company £200k for unsolicited marketing texts.
- the most important thing to her was using the personal information she had gathered to further the spread of her message and the need for security and professionalism that comes from having a client list was lost on her.

If I was advising her, what should she be doing?
- Register with the ICO - a £35 annual fee
- Use a proper mailing package such as mailchimp, madmimi, constant contact etc so that she can properly manage her mailing list and those people who are desperate to unsubscribe can do so without the hassle I had.
- a proper mailing package would also be less likely to be hacked, providing she has a decent security password.
- Stop sending texts to people automatically, she is potentially raising the risk of the ICO investigating her. To be able to send marketing texts you have to have the specific permission of the individual.
- Think about the security of the information she is holding. Would she be happy with her personal information being dealt with in this way?

This is the worst case of failing to find out the requirements for running a business with a marketing list that I have come across in a while, that is unless you know better. Let me know.

9 cybersecurity fixes for businesses on a budget

For small businesses, a data breach can be expensive - it could even cost you your business. According to some studies, it’s been estimated that around half of companies are forced out of business within six months of a cyber breach.

One unfortunate trend that’s being picked up is that smaller businesses are increasingly becoming the targets of cybercrime - it’s not just major companies that are being held to ransom by hackers. It doesn’t help that a lot of smaller businesses rely on third-party services and growing amounts of computer equipment, both of which leave them ever more open to the threat of an attack.

It’s the big companies that make all the headlines, but this can be a factor in lulling smaller businesses into a false sense of security when in fact they are most at risk - more than 80 per cent of breaches are estimated to happen to small businesses. But with limited resources, how can you effectively secure your business against cyber threats?

Some of the solutions are obvious; for example 90 per cent of attacks can be avoided if a company uses basic measures such as firewalls, default passwords, VPNs and double authentication.  In addition, there are a few extra quick security fixes you can easily put in place to make sure everyone in the business does their bit to avoid a potentially devastating security breach.

1. Update your PC

Out of date software may not be supported or updated, leaving it open to threat. If you have any computers still running Windows XP, for example, get them upgraded - support and updates for Windows XP haven’t been available since last year!

2. Train your staff

Have a clear data protection policy in place and make sure everyone is clear about what they can and cannot store on their personal computers.

3. Keep sensitive data protected

Don’t use the same computer for storing sensitive data that you use for checking office email or surfing the web, keep a dedicated machine just for that purpose.

4. Review your stored information

Review the information that’s stored on your server(s) on a regular basis and make sure that confidential or financial data is properly protected.

5. Keep PCs well protected

Check that all your office PCs, laptops and tablets have automatic software and antivirus updates enabled and keep firewalls switched on.

6. Plan ahead

Put together a backup plan, which includes things such as who you need to call to arrange offsite backup if the worst happens, whether it’s hackers, a fire or flood, or physical theft of equipment. Keep a record of insurance policy details and what policies actually cover. 

7. Do your homework

Keep a close eye on computer logs and occasionally review them as they will prove valuable during an incident. Well maintained logs help you to understand what your computers normally do, which could help you spot hackers before they cause any damage.

8. Consider using a managed security service

Managed security services give you an extra layer of protection, and peace of mind that your business is as well-protected as a larger firm.

9. Support knowledge sharing

If we all share our actionable data on cyber breaches, it means that experts get an update on shared threats that exist. Knowing what’s out there gives the experts the opportunity to come up with an analytic approach to reflect the risk of cyber threats.

Do you have a security policy in place? If you’re unsure of how to protect your data, contact me and I will be delighted to provide you with guidance and advice.