• Loss or theft of paper records or loss or theft of equipment on which data is stored, e.g. a laptop, mobile phone, tablet device or memory stick;
• A letter or email containing personal and/or confidential data sent to the wrong address (including internal staff or third parties) or an email to an unauthorised group of email boxes;
• Personal data disclosed orally in error in a meeting or over the phone – including “blogging”, where information is obtained by deceiving The Organisation or where information has been disclosed without confirming the true identity of the requester;
• Unauthorised access to information classified as personal or confidential, e.g. attaching documents to an outlook diary appointment that is openly accessible;
• Posting information on the world wide web or on a computer otherwise accessible from the Internet without proper information security precautions;
• Sensitive information left on a photocopier or on a desk in County Council premises;
• Unauthorised alteration or deletion of information;
• Not storing personal and confidential information securely;
• Not ensuring the proper transfer or destruction of files after the closure of offices/buildings, e.g. not following building decommissioning procedures;
• Failure to safeguard/remove personal data on office equipment (including computers and smartphones) before disposal/sale.

Examples of Breaches caused by IT Security Incidents:

• Unauthorised access to IT systems because of misconfigured and/or inappropriate access controls;
• Hacking or phishing attacks and related suspicious activity; 
• Virus or malware attacks and related suspicious activity; 
• ICT infrastructure-generated suspicious activity;
• Divulging a password to another user without authority.