{"id":12671,"date":"2025-01-07T09:08:45","date_gmt":"2025-01-07T09:08:45","guid":{"rendered":"https:\/\/baticlick.com\/?page_id=12671"},"modified":"2025-05-23T10:44:20","modified_gmt":"2025-05-23T10:44:20","slug":"incidents-databreach","status":"publish","type":"page","link":"https:\/\/baticlick.com\/en\/incidents-databreach\/","title":{"rendered":"Incidents & Data Breaches"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Security Incidents & Data Breach Management Policy and Procedure\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Security Incidents & Data Breach Management Policy and Procedure<\/p>

14 April 2025<\/p>

Incident Management Plan<\/strong><\/p>

Introduction<\/strong><\/p>

This plan sets out the procedures for identifying, responding to, mitigating and recovering from cyber security incidents affecting monecopote.com<\/strong>. The aim is to ensure the platform operates smoothly in accordance with current laws and regulations and to protect it from cyber threats.<\/p>

Baticlick is committed to exercising due care and attention to (i) taking preventive measures against cyber incidents, (ii) dealing with them appropriately when they occur, (iii) providing information to staff and other relevant parties (users, sellers, customers, partners, contractors, suppliers, authorities) as necessary, and (iv) restoring access and operations as soon as possible.<\/p>

Incident categories<\/strong><\/p>

Potential threats include:<\/p>

DDoS Attacks \u2013 Disrupting website availability.<\/p>

Malware Infections \u2013 Injecting malicious code into the platform.<\/p>

Unauthorised Access \u2013 Data breaches or account takeovers.<\/p>

Payment Fraud \u2013 Fake transactions affecting users.<\/p>

Phishing\/Social Engineering \u2013 Attacks on administrators or users.<\/p>

Preventive measures <\/strong>Factors to be considered in this context include:<\/p>

Regular security audits \u2013 Carry out periodic penetration testing.<\/p>

Strong access controls \u2013 Use MFA and role-based permissions.<\/p>

Data encryption \u2013 Secure sensitive information.<\/p>

Web Application Firewall (WAF) \u2013 Protect against attacks.<\/p>

Backup and disaster recovery \u2013 Ensure that daily backups are stored securely.<\/p>

Incident detection and reporting<\/strong> shall be carried out as follows:<\/p>

Monitoring of traffic and logs by an external service provider<\/p>

Users can use a contact form to report suspicious activity<\/p>

Automated alerts for unusual traffic or login attempts<\/p>

Incident response steps<\/strong><\/p>

When an incident is detected, it is crucial to follow a structured approach to contain and mitigate the threat effectively. The following five-phase response process will be implemented:<\/p>

  1. Identification & Classification <\/u>(to determine whether an incident has occurred and assess its severity.)<\/li><\/ol>

    Initial detection through system monitoring and the review of user reports on suspicious activities (e.g. unauthorised logins, fraudulent transactions)<\/p>

    Log and analyse data by collecting logs from affected systems, including access logs, error logs and network traffic, and by identifying attack vectors (e.g. phishing, malware, SQL injection).<\/p>

    Classify the incident: Low severity for minor security issues (e.g., failed login attempts); medium severity for incidents with potential impact (e.g., small-scale malware infection); high severity for active threats affecting users or business operations; critical severity for major security breaches (e.g., data leaks, ransomware attacks)<\/p>

    Activate the response team by notifying the incident response lead and IT security<\/p>

    2. Containment (to l<\/u>to limit the spread and damage caused by the incident whilst preserving forensic evidence.<\/p>

    Short-term actions:<\/em><\/p>

    Network containment (Block malicious IP addresses or impose geographical restrictions on access where necessary; isolate affected systems from the main network)<\/p>

    Account containment (Disable compromised user and admin accounts; enforce password resets for affected users)<\/p>

    Containment measures (Temporarily disable affected website functions (e.g., payment gateway, order processing); update firewall rules to block malicious traffic.).<\/p>

    Long-term actions:<\/em><\/p>

    Secure backups (Check that recent backups are intact; if necessary, redirect traffic to a backup server)<\/p>

    Preserve evidence (Make copies of the relevant system logs for forensic analysis; document all actions taken during containment)<\/p>

    3. Eradication and recovery<\/u> (to eliminate the root cause of the incident and restore normal operations.).<\/p>

    Eradication Steps:<\/em><\/p>

    Identify the attack vector (analyse logs, malware signatures and attack patterns; determine whether the cause was human error, a system vulnerability or an external attack)<\/p>

    Address vulnerabilities (apply software updates, security patches and configuration fixes; strengthen firewall, authentication and API security)<\/p>

    Malware removal (run antivirus\/malware scans on affected systems; delete or quarantine infected files)<\/p>

    Recovery Steps<\/em>:<\/p>

    Restore services (reinstall affected applications if necessary; restore data from backups, ensuring there is no reinfection by malware)<\/p>

    Monitor for any remaining threats (carry out post-recovery penetration testing; step up log monitoring for unusual behaviour)<\/p>

    4. Communication & notification<\/u> (to ensure timely and transparent communication with stakeholders)<\/p>

    Internal communication (inform management, IT and legal teams; hold a status update meeting with the response team)<\/p>

    External communication (notify affected users; advise users to reset their passwords and enable two-factor authentication; if legally required, report breaches to data protection authorities; inform third-party vendors if their services were affected)<\/p>

    5. Post-incident review and lessons learnt<\/u> (to improve security measures to prevent future incidents)<\/p>

    Shares<\/em>:<\/p>

    Conduct an incident review (analyse logs, attack vectors and the effectiveness of the response; identify gaps in detection, containment and recovery processes)<\/p>

    Document findings (draw up a detailed report including a root cause analysis and action points; recommend improvements to security policies)<\/p>

    Strengthen security controls (update firewall rules, IDS\/IPS settings and access controls; provide further training for staff to recognise cyber threats)<\/p>

    \u00a0<\/strong><\/p>

    Contact & Response Team<\/strong><\/p>

    Incident response lead: Ga\u00ebtan Bio<\/p>

    IT security contact: Ga\u00ebtan Bio<\/p>

    Legal and compliance contact: Ga\u00ebtan Bio<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    \u00a0<\/p>

    Appendix 2: Incident Response Instructions for IT Systems<\/strong><\/p>

    Dos<\/strong>
    Immediately isolate the affected system to prevent further problems. Use telephone communication rather than email. Save all logs, such as firewall and system logs. Create backup copies of any damaged files and store them securely. Determine the affected system\u2019s location within the network. List all systems connected to the affected system. Identify the programmes running on the system, the impact of the issue, and the acceptable downtime. If the system is seized as evidence, ensure services continue by using backups or a redundant system.<\/p>

    DON\u2019Ts<\/strong>
    Do not discuss the matter with anyone other than your manager or designated contacts. Do not delete or alter any files on the affected system. Do not contact the person under suspicion. Do not carry out any forensic analysis.<\/p>

    Appendix 3: Overview of Privacy Risk Ratings<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    \u00a0<\/p>
    Factor<\/td>RISK RATING<\/td><\/tr>
    LOW<\/td>MEDIUM<\/td>HIGH<\/td><\/tr>
    Nature of personal information<\/td>Publicly available personal information not linked to any other information<\/td>Personal information specific to the organisation that is neither medical nor financial in nature<\/td>

    Medical, psychological, counselling or financial information, or a unique public body identification number<\/p>

    number<\/p><\/td><\/tr>

    Relationships<\/td>Accidental disclosure to a contractor who reported the breach and confirmed that the information had been destroyed or returned<\/td>

    Accidental disclosure to a<\/p>

    a stranger who reported the breach and confirmed<\/p>

    destruction or return of the information<\/p><\/td>

    Disclosure to an individual with whom there is some relationship<\/p>

    to or with the knowledge of the affected individual(s), particularly disclosures to interested family members, neighbours or colleagues<\/p><\/td><\/tr>

    \u00a0<\/td>\u00a0<\/td>\u00a0<\/td>Theft<\/td><\/tr>
    Cause of the breach<\/td>A technical error that has now been resolved<\/td>Accidental loss or disclosure<\/td>

    Intentional breach. Cause unknown. Technical error \u2013 if not resolved<\/p><\/td><\/tr>

    Scope<\/td>Very few people affected<\/td>An identified and limited group of affected individuals<\/td>

    Large group or the entire scope of the group not identified<\/p>

    (over 100)<\/p><\/td><\/tr><\/tbody><\/table>
    Containment efforts<\/td>

    The data was properly encrypted<\/p>

    The portable storage device was wiped remotely, and there is evidence that the device was not accessed prior to being wiped<\/p>

    Hard copy files or devices were recovered almost immediately, and all files appear to be intact and\/or unread<\/p><\/td>

    The portable storage device was remotely wiped within hours of being lost, but there is no evidence to confirm that the device was not accessed prior to being wiped<\/p>

    Hard copy files or devices were recovered, but enough time had elapsed between the loss and<\/p>

    recovery that the data might have<\/p>

    has been accessed<\/p><\/td>

    The data was not encrypted<\/p>

    Data, files or devices have not been recovered<\/p>

    Data at risk of further disclosure, particularly through the mass media or online<\/p><\/td><\/tr>

    Foreseeable harm resulting from the breach<\/td>No foreseeable harm resulting from the breach<\/td>

    Loss of business or employment opportunities, personal injury, humiliation, damage to reputation or relationships, social or relational harm<\/p>

    Loss of trust in My Eco Best Friend Loss of My Eco Best Friend\u2019s assets Loss of My Eco Best Friend\u2019s contracts or business Financial exposure<\/p><\/td><\/tr><\/tbody><\/table>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t
    \n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tMore on Baticlick\u2019s Terms and Conditions<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t
    \n\t\t\t\n\t\n\t\n\t\n<\/svg>\t\t<\/div>\n\t\t
    \n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t\t
    \n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
    \n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

    Security Incidents & Data Breach Management Policy and Procedure Security Incidents & Data Breach Management Policy and Procedure April 14, 2025 Incident Management Plan Introduction This plan outlines the procedures for identifying, responding to, mitigating, and recovering from cybersecurity incidents affecting monecopote.com. The goal is to ensure the well-functioning of the platform in compliance with […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-12671","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/baticlick.com\/en\/wp-json\/wp\/v2\/pages\/12671","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/baticlick.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/baticlick.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/baticlick.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/baticlick.com\/en\/wp-json\/wp\/v2\/comments?post=12671"}],"version-history":[{"count":46,"href":"https:\/\/baticlick.com\/en\/wp-json\/wp\/v2\/pages\/12671\/revisions"}],"predecessor-version":[{"id":14443,"href":"https:\/\/baticlick.com\/en\/wp-json\/wp\/v2\/pages\/12671\/revisions\/14443"}],"wp:attachment":[{"href":"https:\/\/baticlick.com\/en\/wp-json\/wp\/v2\/media?parent=12671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}