Overview
A major healthcare company experienced a data breach that exposed sensitive patient data. This case study examines the incident, its impact, and the lessons learned for compliance.
If your organisation needs to build an incident response plan, refer to our DPDPA 2023 Complete Guide.
The Incident
An unauthorized third party gained access to the company's patient database through a compromised vendor account. The breach went undetected for 45 days.
Impact
- 10,000+ patient records compromised
- Regulatory fines and penalties
- Reputational damage
- Loss of patient trust
Root Causes
- Weak vendor access controls
- Inadequate monitoring systems
- Lack of employee training
- No incident response plan
Lessons Learned
- Implement strong vendor risk management
- Deploy real-time monitoring
- Conduct regular security training
- Develop and test incident response plans