A customer data breach does not need to start in the CRM to become a customer experience crisis.
A recent attack on Manchester Airports Group (MAG) attack showed how information collected through everyday services such as parking, Wi-Fi and Fast Track can become part of a much larger security and governance problem when data is scattered across systems, teams and third-party environments.
The attack exposed the personal data of around 8.7 million people, with the stolen information later published online after MAG refused the attackers’ ransom demand. Beyond the immediate security implications, the incident raises a more fundamental question for enterprises: do they actually know where their customer data is, who can access it, and how exposed it becomes as it moves between systems?
Sean McConnell, GovTech Lead at Datactics, told CX Today that the attack is part of a wider pattern.
“This is not a one off. It's the latest in a pattern of these sort of breaches that many public sector services, many public services are not well equipped to manage the data or to protect the data that they rely on.”
The problem extends across the private sector, too, as enterprises accumulate customer information across legacy platforms, business units, applications, APIs and operational services.
Fragmented Data Creates Opportunities for Attackers
The more places customer data appears, the harder it becomes to apply security controls consistently, McConnell warned.
“The fragmentation of these systems and the bad data that is a result of those fragmentations, they simply make breaches more likely because they create weak points in the process.”
Those weaknesses can emerge when different systems use different authentication methods, security configurations or access controls.
“If that fragmentation, for example, includes things like security controls, different systems using different security controls, different authentication, different manners of configuring, these attackers really only need to identify one soft spot in order to get access to everything, or at least to get access to more than they should, which is nothing.”
For customer experience leaders, this makes data governance a much broader concern than simply maintaining accurate customer records.
Different teams may classify the same information differently. Older systems may remain connected to live data, permissions may vary between applications and data may be duplicated without a clear understanding of where every copy resides.
“This whole level of fragmentation introduces inconsistency and inconsistency is a weakness that can be taken advantage of,” McConnell said.
After a Breach, Visibility Becomes Critical
Once customer data has been stolen, good governance cannot put it back. It can determine how quickly an organization understands what happened.
McConnell argued that poor-quality data makes that process significantly harder.
“Messy data increases exposure and makes those breaches harder to contain. It creates a larger attack surface and makes it more difficult to assess the damage once an attack or a breach has happened.”
Duplicate records can mean duplicate exposure, as some copies may sit inside well-protected environments, while others could be stored in less secure systems. The result is uncertainty over exactly what attackers accessed.
“If you're keeping copies of data, are they out of date? Have we got the most recent versions that have been made visible to these attackers?” McConnell said.
That can quickly become a customer communications problem. An organization needs to establish what information was compromised, which customers were affected, and whether the exposed records were current.
