New Delhi: The all the contents leakage in the employee’s database of HCLTech has once again brought in doubt about security of employee’s data in large IT companies. According to a hacker group, data is in their possession of people at HCLTech. But HCLTech has so far denied that it had suffered any confirmed incident of break ins.
The IT services provider said its initial investigation showed it did not believe there was a breach of the systems or that there was any effect on any customer engagements. HCLTech is keen in understanding the claims and keeping an eye on its infrastructure.
It is like in the case of Tata Consultancy Services (TCS), where the threat-intelligence alerts brought the same worries that employees’ information may have been compromised. Later, TCS indicated that, during investigation, it did not come across any credible evidence of breach in its system or in the customer environment.
Does this mean employee data is safe?
Evidence to date doesn’t point to a breach of HCLTech’s current employee records. Therefore, it is important to employees that personal data may not have been stolen just because the claim has been made by hackers.
The incident, however, highlights the fact that while any company can hold its own data 100% safe, that’s never guaranteed, either. Massive IT organizations play huge numbers of information records of employment, contact particulars, names of staff and so on. This information is something that cybercriminals could target.
One other reminder is that the information that’s online does not necessarily imply that the company’s primary systems were hacked. This data might be from another database, another service, a user’s account or from any other source. HCLTech’s claims, for instance, have been restricted to only providing the information cited in the claims and have been made for several years.
What should employees do?
Staff should be alert but not panicked. They need to avoid sending unauthorized emails, or messages or calling back with their passwords, OTPs or other personal ID details. Other steps that can help minimize misuse of accounts include choosing strong and distinctive passwords and using multi-factor authentication as needed.
Companies, on the other hand, need to conduct regular system check-ups, with the third parties and older databases involved. They also need to quickly inform employees if a genuine breach is confirmed.
For the time being, it is just the hackers’ assertions that should not be alone enough to convince HCLTech employees that their data has been compromised. Concurrently, the event serves as a mosaic that the data security role is continuous one. In absence of any definitive evidence of a company-system breach, it has to be assumed that there is a claim of exposure until HCLTech completes its investigation.
