When data theft becomes personal: what we discussed at The Chelmsford Club

Share

This morning we had the pleasure of joining the Inner Circle breakfast at The Chelmsford Club, following an invitation from Chairman Chris Davy, to talk about cyber attacks, data theft and what happens when information a business has been trusted to hold ends up in somebody else''s hands.

The breakfast was excellent, the staff made us feel genuinely welcome and the building itself has real character. There is something fitting about sitting in one of Chelmsford''s long established business institutions discussing one of the most modern risks facing companies today. What made the morning particularly worthwhile, though, was not the setting or the presentation. It was the quality of the conversation with the members.

When you bring together people who genuinely care about the businesses they have built, the customers who trust them and the reputations attached to their names, cyber security stops being an IT conversation very quickly. Members wanted to understand what these incidents actually mean in practical terms. We talked about where data is stored, who controls it, how software as a service fits into the picture, what happens when a third party is attacked, what those terms and conditions actually mean, and how far an attacker might be able to travel once through the first door.

Those are the conversations that matter, because business owners do not run organisations in technical terminology. They think about customers, staff, cash flow, contracts, reputation, professional responsibility and whether the business can still operate tomorrow morning.

We know the value of what we have built. Do we know the value of the data behind it?

Most successful businesspeople have a good understanding of value. They know what their company turns over, what their property is worth, what sits in investments and pensions, and what an important contract or customer relationship means to the organisation.

What is often less obvious is the value of the information sitting behind all of those things.

Customer records, contracts, employee information, bank details, legal documents, identity information, intellectual property, passwords and years of correspondence can easily become treated as ordinary business data. Yet to somebody trying to attack you, these are not simply files sitting on a server. They are intelligence.

One document may identify an important supplier. An email conversation may show how you communicate with your accountant. A customer record may provide enough personal information to make a later impersonation attempt credible. A legal document might reveal an asset or a transaction. A compromised mailbox may provide months or years of context about how money moves through a business and which people are trusted to authorise it.

The more genuine information an attacker obtains, the more convincing the next stage of an attack can become. That was one of the central points from our discussion.

The real value of stolen data is not simply what somebody will pay for it. It is what that information allows them to do next.

And what it allows them to do next can have personal, professional and corporate consequences.

Where the consequence lands	What stolen information can enable
Personal	Impersonation, identity fraud, account takeover, convincing phishing, financial loss and targeting of family members
Professional	Exposure of client information, confidentiality failures, regulatory scrutiny, claims, loss of trust and professional liability
Corporate	Operational disruption, lost revenue, recovery costs, regulatory action, supply chain damage and reputational loss

A breach therefore does not have one victim. Depending on the information taken, it can create a chain of victims extending well beyond the organisation originally attacked.

Serious incidents can start with something remarkably ordinary

We discussed how major incidents can begin with something as simple as an email, a reused password or an employee entering credentials into a convincing fake website. The initial event may be small. What matters is how far the attacker can travel after that first foothold has been established.

South Staffordshire Water provides a striking example. Its cyber incident began after an attachment in a phishing email was opened. Malware entered the organisation and remained undetected for nearly two years. The attacker eventually obtained administrator level privileges, and personal information relating to 633,887 people was extracted and published on the dark web. The Information Commissioner''s Office subsequently imposed a fine of £963,900, and said the information affected included customer and employee data, leaving people exposed for an extended period.

It would be easy to tell that story as an example of an employee opening the wrong attachment. That would miss the bigger lesson. Human beings make mistakes. The real question is why one mistake should be capable of developing into privileged access, remaining undetected for such a long period, and ultimately providing a route to information belonging to hundreds of thousands of people.

Cyber resilience should therefore be about more than trying to prevent every mistake. It should also be about limiting the distance a mistake can travel.

Stansted made the conversation immediately relevant to Essex

For a room in Chelmsford, the recent incident involving Manchester Airports Group and London Stansted Airport made the discussion particularly close to home.

On 27 August 2026, Manchester Airports Group confirmed that an unauthorised third party had obtained customer information relating to car park, lounge and Fast Track bookings and airport Wi-Fi registrations across Manchester, Stansted and East Midlands airports.

MAG was clear that airport operations were unaffected, that passenger safety and aviation security were not compromised, and that the affected system did not contain customers'' bank or payment details. The information obtained included email addresses, telephone numbers, vehicle registrations and postcodes.

Information obtained	Why it can still matter
Email address	Provides a genuine communication route
Telephone number	Enables SMS, messaging and voice contact
Postcode	Adds location and identity context
Vehicle registration	Links the individual to a genuine activity and a real world asset

The point is not that the MAG incident automatically results in fraud. There is no evidence to make that claim. The point is context.

Imagine receiving a message about an airport parking booking, a refund or Fast Track access. If the person contacting you already appears to know your telephone number, postcode and vehicle registration, the approach immediately looks more convincing than random spam.

That is where the personal implication begins. Information does not need to contain a bank account number to become useful in constructing a believable fraud.

For the professional or business holding the information, the implication is different. Customers gave that information to the organisation for a legitimate reason. Once it has left the organisation''s control, those customers may need to change how they assess future communications, even though they did nothing themselves to cause the breach.

A data breach can become somebody else''s fraud problem

Once information has been copied or stolen, the organisation no longer controls how many times it is duplicated, who receives it, or what other information it is combined with.

Government backed modelling prepared for the Department for Science, Innovation and Technology and the Home Office has estimated that organisational data breaches resulted in approximately 437,000 people becoming fraud victims, with an estimated societal cost of around £755 million. That is modelling rather than a definitive count, but it provides an important link between data lost by organisations and fraud experienced by individuals.

The wider UK picture is already substantial. The Government''s 2026 Fraud Strategy reports £3.5 billion in fraud losses reported to Action Fraud in the year to October 2025, at an average of approximately £10,300 per report. Fraud accounted for 45 per cent of all crime, with around 3.6 million adult victims estimated in the year to September 2025.

Not all of that fraud originated from organisational data breaches, so the figures should not be conflated. What they demonstrate is the size of the economy into which stolen identities, credentials and personal information can ultimately feed.

This is why describing a breach as involving hundreds of thousands of records can make the event sound strangely impersonal. Those records belong to people. For the individual, the consequence may continue long after the breached organisation has restored its systems. Fraudulent credit applications, account takeover, highly personalised phishing, impersonation and repeated attempts to obtain additional information can follow stolen identity data around for years.

What does stolen information sell for?

Dark web marketplace monitoring provides another way of understanding the economics. SOS Intelligence analysed underground marketplaces during the first quarter of 2026. The figures below are observed listing ranges, not a fixed criminal tariff. Prices vary according to supply, demand, account value, freshness and the quality of the information being offered.

Data or access being sold	Indicative 2026 criminal market price
Credit card with CVV	$10 to $40
Verified PayPal account	$15 to $55
UK or EU bank login	$50 to $1,000 and above
Individual identity package	$20 to $100 on observed US listings
VPN access to an SME	$200 to $1,000
Access to a customer database	$500 to $10,000
Cloud infrastructure access	$1,000 to $20,000
Enterprise domain administrator access	$5,000 to $50,000 and above

The table demonstrates an uncomfortable imbalance. An attacker does not need to spend £25,000 to create a £25,000 loss. Useful identity data may cost tens of dollars. Access to an SME network might cost a few hundred. Access to an established customer database or cloud environment may cost a few thousand.

The criminal''s acquisition cost can be tiny compared with the financial, professional and commercial consequence of what happens afterwards. That is precisely why the real value of stolen data is not what somebody pays for it. It is what that information allows them to do next.

The personal consequence can be far more than a replacement bank card

Financial loss is the easiest consequence to quantify, but it is not the only personal one.

When somebody''s identity information is stolen, the individual can be forced to spend considerable time proving that transactions were not theirs, changing credentials, replacing cards, checking credit records and becoming suspicious of communications that would previously have appeared routine.

The victim may also have no control over which pieces of information were copied, how many times they are resold, or whether the information is combined with data taken from an entirely different organisation.

M&S showed what digital dependency really means

Marks and Spencer made the same point at another scale. Following its 2025 cyber incident, M&S initially estimated an impact of around £300 million on operating profit before mitigation, insurance and trading actions. Its final 2025 and 2026 results recorded £131.3 million of incident related costs, including £109.3 million associated with systems response and recovery, plus specialist legal and professional support.

The scale is striking, but the more useful comparison for a smaller business is what M&S had available to respond. It had specialist advisers, insurers, technology teams, management depth and access to capital. Many small and medium sized businesses do not have those resources waiting in reserve.

So the useful question is not whether an incident can happen to a business the size of M&S. We already know it can. The useful question is what several weeks of digital interruption would mean to a company with 20, 50 or 100 employees.

How long could staff work manually? How quickly would customers go elsewhere? How much working capital would be needed? How much management time would disappear into recovery rather than running the business?

JLR showed why the biggest loss may not sit with the company that was attacked

Jaguar Land Rover was perhaps the strongest example from the discussion, because it demonstrates how far the economic effect of one cyber incident can travel.

JLR reported approximately £196 million of cyber related costs following its September 2025 incident. The Cyber Monitoring Centre subsequently modelled the wider UK financial impact at approximately £1.9 billion, with an estimated range of £1.6 billion to £2.1 billion and more than 5,000 UK organisations affected across the multi tier supply chain, logistics operations, dealerships and other downstream businesses.

JLR cyber incident	Scale
Reported cyber related costs	£196m
Modelled wider UK economic impact	£1.9bn
Estimated organisations affected	5,000 and above
Wider impact versus direct reported cost	Almost ten times

This does not establish a rule that every cyber incident produces a ten times multiplier. It shows what happens when the organisation being attacked sits at the centre of a deeply connected commercial ecosystem.

When production stops, suppliers lose orders. When orders stop, cash flow tightens. When suppliers come under pressure, employees, households and local communities can feel the consequences.

That creates two questions worth asking in every boardroom. If our systems stopped tomorrow, who else would lose money because of us? And which organisations do we depend upon that could prevent us operating if exactly the same thing happened to them?

Software as a service created some of the most useful questions of the morning

Most businesses now use software as a service every day. Email, CRM, accounting, HR, document management, file sharing, marketing applications and specialist platforms increasingly sit outside the physical walls of the organisation.

That is not inherently a problem. Good providers can offer excellent security, resilience and capability. The National Cyber Security Centre describes cloud security as a shared responsibility model, with responsibility divided between the provider and the customer depending on the service being used.

The problem begins when convenience creates assumptions. We put information into a platform and begin to think that because somebody else now hosts it, responsibility for the information has moved with it. It has not necessarily done so.

That led to three very simple questions during the breakfast: whose data is it, where is it actually stored, and what did we agree to when we accepted the terms?

The cloud is not really an answer to the question of where our data is

If you asked a management team where their most sensitive customer information was stored, how many would answer with the name of an application rather than actually knowing where the information is processed and held?

The NCSC recommends that customers understand where their data is stored and processed, the legal jurisdictions involved, and the provider''s access to that information. Primary information may sit in one region while backups, support functions or sub processors operate elsewhere. Different supplier employees may have privileged access. Integrations may pass information into additional systems.

None of those things automatically makes a platform unsafe. They simply reinforce why organisations need to understand what they have agreed to.

Question to ask	Why it matters professionally
Where is the information stored?	Determines jurisdiction, availability and potentially legal obligations
Who can access it?	Identifies privileged and third party exposure
Who else processes it?	Reveals sub processor and supply chain dependency
Can we export everything?	Determines whether the organisation can realistically move provider
What happens when we leave?	Clarifies retention, backup and deletion arrangements
What happens if they are attacked?	Determines notification and incident response dependency
What does the contract say?	Defines responsibilities, rights and commercial liability

The purpose is not to turn every director into a technology lawyer. It is to move the purchasing conversation from whether the software does what we want, to what we are trusting this platform with. That is a fundamentally different question.

Moving the data does not automatically move the responsibility

The ICO makes clear that controllers using processors must satisfy themselves that the processor offers appropriate safeguards, put proper contracts in place and continue to monitor compliance. Contracts must cover matters such as security, sub processors, data subject rights, incident assistance and what happens to information at the end of the relationship.

That matters enormously in professional environments. If a customer gives your firm sensitive information and you subsequently place it into a third party platform, the existence of that supplier does not mean you can simply tell the customer that what happened next was somebody else''s problem.

The contractual relationship between you and the supplier is one issue. Your relationship with the customer is another. That is where professional liability, regulatory responsibility and customer trust can collide.

What does a serious data breach cost the organisation?

The latest IBM Cost of a Data Breach research, published in July 2026, puts the average UK organisational data breach at approximately £3.13 million, with higher averages in several sectors.

UK data breach benchmark	Average cost
UK average	£3.13m
Financial services	£5.46m
Services	£4.23m
Energy	£4.03m

These figures are not predictions for every smaller business. The study looks at significant breaches within the organisations examined. Their value is in demonstrating what happens when a data breach moves beyond the initial compromise into investigation, disruption, customer response, recovery and lost business.

One piece of data, three different consequences

Perhaps the easiest way to bring the conversation together is to imagine a set of customer information being stolen from a professional firm.

For the individual, the information might be used to impersonate them, target their bank account, obtain further credentials or construct convincing fraud.

For the professional firm, the same event may mean informing the client that confidential information has been lost, reviewing whether appropriate safeguards were in place, dealing with insurers and regulators, and answering uncomfortable questions about suppliers and access.

For the business itself, the incident can mean systems being restricted, billable work stopping, recovery specialists being brought in, customers leaving, and management attention being diverted for weeks or months.

It is the same stolen data. The consequence simply lands in different places.

Where Firevault fits

Nothing in this article suggests that a single control prevents every incident. Our argument is narrower and, we think, harder to argue with.

Most of the damage described above depends on a route. An attacker who reaches a mailbox, a database or a backup platform does so along a network path, usually with credentials that the system regards as legitimate. Where that path does not exist, the copy cannot be reached, exported or encrypted.

That is the principle behind Offline Secure Storage®. Dedicated physical storage, disconnected at Layer 1, reachable only when an authorised out of band instruction opens the connection for a defined window. It does not stop somebody opening the wrong attachment. It limits how far that mistake can travel, and it means the organisation still holds a clean copy of the information it is professionally responsible for.

The wider discipline is the same one the members raised themselves. Know what you hold, know where it is held, know who can reach it, and know what you would still have if the connected estate were unavailable tomorrow morning.

The questions worth taking back to work

The most valuable part of the morning was that we did not finish with a shopping list of cyber products. We finished with questions.

If one employee account was compromised tonight, how far could somebody travel through the organisation? What information would cause the greatest personal harm if it was stolen? What customer or client information are we professionally responsible for protecting? Which platforms and third parties currently hold it? Do we genuinely know where it is stored and who can access it?

There are also contractual questions. What happens when we leave a supplier? What is deleted, and what remains in backup? Which sub processors are involved? What happens when the supplier is breached, and how quickly will we know?

Then come the business questions. If our connected systems were unavailable tomorrow morning, how long could the organisation continue? Which customers would be affected? Which suppliers are we dependent upon? Who else would lose money if we stopped operating?

Those are not simply technology questions. They are questions about personal harm, professional responsibility and commercial resilience.

A morning worth having

We are grateful to Chris Davy for inviting us to join the Inner Circle, and to the staff and members of The Chelmsford Club for making us feel so welcome.

There is a significant difference between presenting to a room and having a genuine conversation with one. This morning was very much the latter.

MAG and Stansted reminded us how close to home personal data exposure can be. South Staffordshire demonstrated how one human action can ultimately expose hundreds of thousands of people. M&S demonstrated the cost of digital dependency. JLR showed that a cyber incident affecting one organisation can become a £1.9 billion economic event involving more than 5,000 other organisations. And the discussion about hosted platforms brought everything back to something much closer to every business around the table: where is our information, who controls it, who can access it, and what responsibility have we retained even after placing it into somebody else''s platform?

People in the room this morning have spent years, and in many cases decades, building businesses, client relationships, personal wealth and reputations. The information sitting behind those things may have taken just as long to accumulate.

For the individual, losing it can create fraud and identity risk. For the professional entrusted with it, losing it becomes a question of confidentiality, responsibility and trust. For the organisation, losing control of it becomes a financial and operational event.

That is why data theft cannot be viewed simply as the loss of a file.

The real value of stolen data is not simply what somebody will pay for it. It is what that information allows them to do next.

Related reading

• How 4.1TB of breached data cost South Staffordshire Water £963,900
• Airport WiFi sign-ups turn into a national data problem as 8.7 million customer records are accessed
• Marks & Spencer: the £300m cyber lesson
• Jaguar Land Rover: production severely hit by cyber attack
• JLR cyber attack rated Category 3: £1.9bn UK impact
• Offline Secure Storage: everything you need to know

Sources

• ICO: fine of nearly £1m issued against South Staffordshire Water
• London Stansted Airport: data security incident update and FAQs
• GOV.UK: Fraud Strategy 2026 to 2029
• SOS Intelligence: dark web services, current average prices, 2026 update
• Marks and Spencer full year results
• Cyber Monitoring Centre statement on the Jaguar Land Rover cyber incident
• DSIT and Home Office: assessing the feasibility of modelling the link between data breaches and fraud
• Home Office: the economic and social cost of fraud, 2023 to 2024
• NCSC: cloud security shared responsibility model
• NCSC: using software as a service securely
• ICO: contracts and liabilities between controllers and processors
• IBM: Cost of a Data Breach, UK findings

How Firevault would handle this

A recovery copy an attacker cannot reach

Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch.