<\/span>Case Study\u202f2: UK Regulatory Reporting \u2014 Information Commissioner\u2019s Office \/ Egress Systems Findings<\/span><\/h2>\nOverview & key findings<\/strong><\/p>\n\n- The ICO\u2019s \u201cSecurity Trends\u201d reports show that for Q1\u202f2020\/21, mis\u2011directed emails (data emailed to wrong recipient, sent to wrong person, failure to BCC) were the top cause of reported incidents \u2014 ahead of phishing. (egress.com<\/a>)<\/li>\n
- One note from Egress: \u201chuman error is the greatest risk \u2026 such as accidentally mis\u2011directing an email to the wrong recipient or attaching the wrong file.\u201d (cyberlogic.co.za<\/a>)<\/li>\n
- According to a CISO strategy\u2011guide: 48\u202f% of organizations had employees leave as direct result of outbound email security incident (27\u202f% dismissed, 21\u202f% voluntary). (Pub Media Box Storage<\/a>)<\/li>\n<\/ul>\n
Why this case matters<\/strong><\/p>\n\n- It underscores that regulatory reporting backs up the human\u2010error risk: the \u201cnon\u2011cyber\u201d incidents (i.e., not external attacker) still dominate.<\/li>\n
- The fact that attachment errors and wrong recipients are leading causes of data\u2011loss shows this is a practical operations risk.<\/li>\n
- The consequence for employees (dismissal, turnover) shows the human\u2011error risk affects personnel, not just systems.<\/li>\n<\/ul>\n
Lessons learned<\/strong><\/p>\n\n- Compliance teams need to treat mis\u2011sent emails as full\u2011blown incident types \u2014 tracking, reviewing, remediating.<\/li>\n
- Policies around \u201coutbound email\u201d must be strengthened (recipient verification, attachments, BCC practices).<\/li>\n
- Employee culture, fatigue, workload are factors \u2013 not just tools.<\/li>\n
- Incident\u2011response must include \u201cnear\u2010miss\u201d tracking (not only external attacks).<\/li>\n<\/ul>\n
\n