Threats to Information

Risks to Information Held on Computers

Every organisation that uses computers stores information that can be damaged, stolen or misused. Understanding the different types of risk is essential for protecting data and avoiding serious harm to individuals and businesses alike.

Accidental Damage

Not every threat is deliberate. Accidental damage can occur when a user accidentally deletes important files, a hard drive fails without warning, or a power surge corrupts data. Human error is one of the most common causes of data loss in the workplace.

Another accidental risk comes from incorrectly assigned access levels. If a system administrator gives a member of staff access to files they should not see, that employee may unintentionally disclose sensitive information to others or use data in ways that were never intended. This is sometimes called unintended disclosure, and it can have serious legal consequences under data protection law.

Malicious Software

Malware is an umbrella term for any software deliberately created to cause harm. There are several distinct types that you need to know.

A virus is a program that attaches itself to a legitimate file and spreads when that file is copied or shared. A worm is similar but spreads automatically across networks without needing a host file. A Trojan horse disguises itself as useful software to trick users into installing it, then carries out harmful actions in the background.

Spyware secretly monitors a user's activity, collecting passwords, browsing history or financial details without consent. Ransomware goes further — it locks or encrypts the victim's files and demands a payment, often in cryptocurrency, before restoring access. High-profile ransomware attacks have crippled hospitals, schools and businesses worldwide.

A Distributed Denial of Service (DDoS) attack floods a server or website with so much traffic that it becomes overwhelmed and unavailable to legitimate users. This is often carried out using a network of infected computers called a botnet. Finally, key-logging software silently records every keystroke a user makes, allowing attackers to harvest login credentials and financial data over time.

Hacking

Hacking refers to gaining unauthorised access to a computer system or network. However, not all hackers have the same intentions. Security professionals distinguish between three groups using a colour-coded classification.

A white hat hacker works ethically and legally, often employed by organisations to find security vulnerabilities before criminals can exploit them. This is known as penetration testing. A black hat hacker breaks into systems without permission, motivated by financial gain, malice or curiosity, and their actions are illegal. A grey hat hacker sits between the two — they may access systems without permission but typically notify the organisation of vulnerabilities rather than exploiting them maliciously.

Social Engineering

Social engineering exploits human psychology rather than technical flaws. The most common form is phishing — sending emails that appear to come from trusted sources, such as a bank or a manager, to trick recipients into clicking malicious links or entering login credentials. Other techniques include pretexting (inventing a believable scenario to extract information), baiting (leaving infected USB drives where victims will find them) and vishing (voice phishing over the phone).

The Impact of Data Loss, Theft or Manipulation

When data is lost, stolen or altered without authorisation, the consequences can be severe and wide-ranging. Both individuals and businesses face a range of financial, legal, moral and operational impacts.

Financial Implications

Businesses may face enormous costs following a data breach. These include paying ransom demands, funding IT forensics investigations, compensating affected customers and investing in new security infrastructure. A competitor who gains access to confidential pricing strategies or product plans gains an unfair financial advantage that can permanently damage the victim organisation's market position.

Moral and Legal Implications

Organisations have a moral responsibility to protect personal data entrusted to them by employees, customers and partners. Breaching this trust is not only ethically wrong but also illegal. Failing to comply with UK GDPR and the Data Protection Act 2018 can result in regulatory fines, prosecution and mandatory reporting obligations. Individuals whose data is leaked may become victims of identity theft, fraud or blackmail — harm that the organisation is morally accountable for enabling.

Data Manipulation and Loss of Service

Data manipulation occurs when an attacker alters records rather than simply stealing or deleting them. This can be especially damaging because the changes may go undetected for some time. For example, if a hospital's patient records are silently altered, treatment decisions could be based on incorrect information with life-threatening consequences. Loss of service — as seen in DDoS attacks — prevents customers from accessing websites or online platforms, leading to lost sales and eroded trust.

Loss of Intellectual Property and Reputation

Intellectual property (IP) such as product designs, source code, research data or creative content represents a business's competitive advantage. If this is stolen, competitors can replicate innovations without the investment, destroying the original creator's market edge. Alongside this, a business that suffers a publicised data breach often experiences lasting reputational damage. Customers lose confidence, partners withdraw and the business may struggle to recover even after the technical issue is resolved.