Summary
As massive repositories of computing power and data with high-speed connectivity to the backbone of the internet, data centres naturally make attractive targets for threat actors seeking to exfiltrate data for sale or ransom, steal computing power for cryptocurrency or botnets, or disrupt supply chains and services. Besides direct attacks on the servers hosted in a data centre, threat actors can also launch attacks against the systems supporting the infrastructure of the data centre itself, such as air-conditioning, water-cooling and security systems, which can result in physical damage to servers. Data centres can also be targets for physical security breaches with the aim of disrupting digital services.
Key takeaways
Such attacks pose a particular risk for data centres because a single attack on a data centre can have a range of impacts on a diverse group of customers from across the world. Customers could suffer outages of key platforms, data breaches affecting millions of individuals, or interruption to upstream systems. Even in the absence of malicious intent, a server misconfiguration can expose data or access credentials directly to the internet.
A data centre operator who suffers such an attack or misconfiguration is likely to have obligations to notify multiple regulators of the incident – under mandatory data breach notification laws, critical infrastructure laws, cybersecurity laws, and stock exchange continuous disclosure rules. Such notifications could be followed by investigations and enforcement action from regulators in multiple jurisdictions.
The fact that a data centre operator stores personal data on behalf of third parties does not necessarily protect it from regulatory consequences. Data protection laws in most jurisdictions impose obligations directly on “data processors” who hold and process personal data on behalf of others.
Data centre operators are also likely to have obligations to notify their affected customers. They are increasingly likely to find themselves facing legal proceedings (including class actions) from customers and affected individuals - seeking to recover losses from interruption to their operations, the costs of notifying regulators and affected individuals and reputational damage. These types of legal actions are gradually becoming more common – partly because businesses are becoming more sophisticated in their responses to cyber incidents, and partly as they become more willing to seek to recover response costs.
In depth
Data centre operators can protect themselves to some extent with contractual limitations on their liability; as with most businesses in the IT sector, contractual provisions limiting liability are standard and customers’ ability to negotiate these caps is often limited. However, these limitations are not always reliable – many of the businesses which suffer loss as a result of an incident will have no direct contractual relationship with the data centre operator, and consumer protection laws may provide consumers and small businesses with additional rights or render liability provisions void.
As such, cyber insurance is critical as a means for data centre operators to manage these risks.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
