Most small business owners think about security in terms of their own computers and their own network. But a few of this week’s headlines point at something just as important: a lot of your customers’ information doesn’t live with you at all. It sits with vendors, platforms, and the tools running on your website. Here’s what stood out.
When the vendor has the incident
Two breach stories this week share a pattern. Blueberry Pediatrics, a telemedicine service, reported an incident involving a vendor that affected about 341,000 patients. Separately, Sony Network Communications, an internet service provider owned by Sony, confirmed a breach exposing roughly 2.5 million records of current and former customers.
We don’t know more than the headlines say, so we won’t guess at causes. But two ideas are worth taking from them. First, when a vendor holds your customers’ data, an incident on their side can still become your conversation with your customers. Second, notice the words ’current and former.’ Information about people who stopped doing business with a company years ago can still be sitting in its systems. It’s worth asking yourself why you’re keeping old customer records, and who else is keeping them for you. Data you no longer need is data that can only cause you problems.
A practical starting point is a simple list of the vendors that touch customer or employee information: billing, scheduling, email marketing, telehealth, payroll, cloud storage. For each one, it’s worth knowing what data they hold, how long they keep it, and how they’d tell you if something went wrong. If you’re in a regulated field such as healthcare, your own advisor can help you understand what your agreements with those vendors should say.
Privacy settings you didn’t choose
Two other stories are about information traveling further than people expect. A study reported by HIPAA Journal found that a meaningful share of the most visited healthcare websites fail core privacy tests. Many websites quietly run third-party tools, such as analytics or advertising scripts, that can pass visitor information to other companies. The business owner often never reviewed what those tools collect.
Meanwhile, Discord announced that it will let search engines index messages in its Discoverable Servers, making them visible on the web to people without an account or invitation. If your business or community uses Discord, it’s a good reminder that platforms change their rules, and a conversation that felt semi-private can become public. A quick check of whether your server is discoverable, and what members have posted there, takes only a few minutes.
The common thread is that your website and your online communities are not ’set it and forget it.’ Reviewing what’s running on your site once or twice a year is a reasonable habit.
Some good news from law enforcement
It wasn’t all bad this week. U.S. law enforcement seized the main domain of Virtualine, a ’bulletproof hosting’ service, which is a type of web hosting that looks the other way when customers use it for crime, including ransomware (malicious software that locks up your files and demands payment). Separately, Artem Stryzhak, an affiliate of the Nefilim ransomware group, was sentenced to 70 months in U.S. prison.
These actions matter, because they make criminal operations harder and costlier to run. But we’d treat them as encouraging news rather than a reason to change your plans. Criminal infrastructure tends to get rebuilt, so the everyday basics still carry the weight: knowing where your data is, limiting who has access, and having a plan for when a vendor calls with bad news.
A few questions to try this week
You don’t need to overhaul anything. Pick one or two of these:
Which vendors hold our customers’ information, and do we have a current contact at each one? Are we keeping records of former customers or employees longer than we need to? Do we know what tracking tools are running on our website? Are any of our online communities more public than we assumed?
If you’d like to talk through how any of this applies to your business, that’s what we’re here for.