Why organizations lose personal data of customers: experts called the main reasons

About 50 notifications of information security incidents related to the processing of personal data were received by the National Center for Personal Data Protection in 2026. We are talking about cases when information systems are disrupted in organizations, information is lost or there is a risk of their getting to outsiders. At the same time, most of these incidents are not related to technical hacks, but to the actions of employees. On November 11, the director of the center Andrey Gaev told reporters, the correspondent of the Minsk-Novosti agency reports.

In just five years, the center has received about 150 incident notifications. About a fifth of them were related to personal data breaches.

According to A. Gaev, the causes of such incidents are different. For example, organizations may use uncertified software, allow employees to work remotely through unsecured communication channels, or allow personal computers infected with viruses to be connected. There are cases when the necessary measures of technical protection of information are not taken at all.

However, not every report of the alleged leak is confirmed. Recently, attackers often present as new incidents information that was stolen earlier, combined from different sources and additionally processed.

- Today, we see that many of the things that are presented as an incident are actually compiled information from previously stolen data. Somewhere it is modified with the help of artificial intelligence, and somewhere it is completely fake. Therefore, the National Center for Personal Data Protection and law enforcement agencies are deeply investigating every circumstance to establish whether there was a leak of personal data or a breach of information infrastructure, Gayev said.

Another problem that the head of the center drew attention to is the use of artificial intelligence. In particular, organizations face cases when employees upload large amounts of information to such systems without assessing the possible consequences of transferring data to external services.

Also, not all incidents involve leaks. Part of the notification concerns the loss or deletion of information when the information becomes unavailable to the organization.

Ah. Gaev noted that over the past five years, major incidents with personal data have become less frequent. According to him, organizations are more serious about protecting information resources, implementing organizational, legal and technical security measures. At the same time, they became more likely to report problems and interact with people whose rights may have been affected.