Evernote data breach: lessons to be learned

Brand damage mitigation, post-breach best practice

Yvonne Eskenzi is director of Eskenzi PR, an agency which specialises in IT security, and unsurprisingly has some thoughts of her own on how Evernote handled things on this occasion

"Did Evernote get it right? If you have a look at all the negative press it's clear Evernote got it very badly wrong and this is going to follow them around like a nasty smell for a very long time as more and more people write about it negatively.

Evernote could have so easily avoided this mess if they followed a few basic rules: Preparation we would advise every business to plan for an incident. It's a bit like preparing for a play. Most of the work is done before the performance so when the actors get on stage they are polished, professional and well rehearsed.

Communication [needs to be carried out] clearly, simply and quickly. You can only do this if you have rehearsed and prepared in advance. The Evernote email was clumsy, inaccurate and difficult to understand. Short, clear and simple should do the trick. Be as honest as you can, your customers will always appreciate an honest truthful explanation.

Use every communication method open to you to jump on the rumours before it spirals out of control. If you provide the content people will use it, if you don't people will make it up.

Unfortunately, with social media, speed is of the essence, but that should be no excuse for a badly written inaccurate email such as Evernotes.

Knowledge is king so gain as much knowledge as you can around the incident and get your facts right, combine this with a smack of honesty and you should be fine. If you keep your audience in the loop and keep them briefed you'll win them over.

You also need to decide who is going to be your spokesperson, in the Evernote email, written by the Evernote team, you couldn't get more impersonal that a general sign-off, someone needs to be accountable and you must have a point of contact. You need to decide long before a breach or incident who has the knowledge and personality to stand up in front of an audience and take the flack and handle it!

Make sure they are media trained. This could be the chance for the CISO to shine as they are the ones with the knowledge.

Organisations need to realise that breaches are becoming more and more of an unfortunate part of our lives and it's not necessarily if, but when it's going to happen to you.

Preparation and communication will stand you in good stead, so that when it happens you're not the company caught with egg on your face"

Davey Winder

Davey is a three-decade veteran technology journalist specialising in cybersecurity and privacy matters and has been a Contributing Editor at PC Pro magazine since the first issue was published in 1994. He's also a Senior Contributor at Forbes, and co-founder of the Forbes Straight Talking Cyber video project that won the ‘Most Educational Content’ category at the 2021 European Cybersecurity Blogger Awards.

Davey has also picked up many other awards over the years, including the Security Serious ‘Cyber Writer of the Year’ title in 2020. As well as being the only three-time winner of the BT Security Journalist of the Year award (2006, 2008, 2010) Davey was also named BT Technology Journalist of the Year in 1996 for a forward-looking feature in PC Pro Magazine called ‘Threats to the Internet.’ In 2011 he was honoured with the Enigma Award for a lifetime contribution to IT security journalism which, thankfully, didn’t end his ongoing contributions - or his life for that matter.

You can follow Davey on Twitter @happygeek, or email him at davey@happygeek.com.