TL;DR

This week alone saw breaches at DentaQuest (2.6 million records), the UN World Food Programme (600,000 Gaza households), and a Magecart campaign abusing Stripe's infrastructure to steal credit cards. Most breaches exploit gaps that straightforward controls — encryption, backups, DLP, and access management — would have neutralized. Here is a playbook you can start implementing Monday morning, with tool names, cost estimates, and a quick-win checklist.

Why Data Protection Can't Wait

The headlines from this week alone are a masterclass in what goes wrong. DentaQuest lost 2.6 million patient records. The UN's World Food Programme exposed data on 600,000 vulnerable households. A Magecart skimming campaign weaponized Stripe's own API to host stolen card data. These aren't exotic zero-days — they're failures of basic data protection hygiene. The organizations that weather these incidents have four things in common: encrypted storage, verified backups, data loss prevention policies, and tight access controls. Here's how to build all four in a week.

1. Encryption at Rest and in Transit

Encryption is your last line of defense when everything else fails. If an attacker exfiltrates an encrypted database or lifts an encrypted laptop, the stolen data is unusable without the key.

At rest — endpoints and servers:

  • BitLocker (Windows Pro/Enterprise, included with license): Full-disk encryption for every workstation and laptop. Enable via Group Policy across the domain. Zero additional cost if you already run Windows Pro.
  • VeraCrypt (free, open source, Windows/macOS/Linux): Creates encrypted volumes for sensitive file storage. Ideal for shared workstations or machines running Windows Home editions that lack BitLocker. NIST SP 800-111 provides detailed guidance on storage encryption architectures and key management.
  • LUKS (Linux): Full-disk encryption baked into most Linux distributions. Use during server provisioning — retrofitting is painful.

In transit — network and API layer:

  • Enforce TLS 1.2+ on every external-facing service. Use free certificates from Let's Encrypt for web properties.
  • Require VPN (WireGuard or Tailscale) for all remote access to internal systems. Tailscale's free tier covers up to 100 devices — enough for most SMBs.
  • For email, enforce TLS for inbound/outbound mail and consider S/MIME or PGP for highly sensitive communications.

Cost estimate: $0–$50/month. BitLocker is included with Windows Pro licenses. VeraCrypt is free. Tailscale free tier handles most small teams. Let's Encrypt certificates are free.

2. The 3-2-1 Backup Rule

The Australian Cyber Security Centre (ACSC) explicitly recommends the 3-2-1 strategy: three copies of your data, on two different media types, with one copy off-site. This is not theoretical — ransomware routinely destroys primary storage and any connected backups. The off-site copy is your escape hatch.

Implementing 3-2-1 this week:

  1. Primary copy — your production data on servers or workstations.
  2. Local backup — a NAS or external drive on-premises. Veeam Backup Free Edition (up to 10 instances) handles VMware and Hyper-V environments at no cost. For file-level backup, SyncBackFree handles Windows; rsync with cron handles Linux.
  3. Off-site backup — cloud-based. Backblaze B2 at $6/TB/month is the budget leader. Wasabi is another option at similar pricing. Both are S3-compatible, so Veeam or any standard backup tool can write directly to them.

Verification is non-negotiable. Backups you haven't tested are just wishful thinking. Schedule a monthly restore test: pick a random file, restore it, confirm integrity. Document the result. If you use Veeam, its SureBackup feature automatically verifies recoverability in an isolated environment.

Cost estimate: $0–$100/month for a typical SMB (1–5 TB of data). Veeam Free covers small environments. Backblaze B2 runs ~$6/TB/month. A 2-bay NAS for local backup is a one-time $200–$400 hardware cost.

3. Data Loss Prevention (DLP)

DLP policies detect and block sensitive data from leaving your organization — whether through email, cloud uploads, USB drives, or (increasingly relevant this week) AI agents with excessive data access. A CyberScoop report this week highlighted how AI agents are becoming the new insider threat, making DLP more critical than ever.

Start with classification:

You cannot protect what you cannot see. Before deploying DLP tools, classify your data:

  • Public — marketing materials, published content.
  • Internal — business plans, project documentation.
  • Confidential — customer PII, financial records, health data.
  • Restricted — encryption keys, credentials, trade secrets.

Tool options by budget:

  • Microsoft Purview DLP (included in Microsoft 365 E3+/Business Premium): Policy-driven detection of SSNs, credit card numbers, health records across Exchange, SharePoint, OneDrive, and Teams. If you already have M365 Business Premium ($22/user/month), DLP is included — you just need to turn it on.
  • Varonis (enterprise, pricing varies): Automated data classification, permission analysis, and threat detection. Strong for organizations with large file shares and complex permissions. Pricing typically starts around $50,000/year — better suited for mid-market and above.
  • OpenDLP (free, open source): A starting point for scanning and identifying sensitive data across file systems. Requires technical expertise to deploy.

Quick-win DLP policies to enable immediately:

  • Block USB mass storage on company workstations via Group Policy or MDM.
  • Configure email DLP rules to flag or block outgoing messages containing SSN patterns, credit card numbers, or health record identifiers.
  • Restrict third-party AI tool access to internal documents — review OAuth grants to tools like ChatGPT, Copilot, and Gemini.

Cost estimate: $0–$200/month. If you have M365 Business Premium, DLP is already paid for. OpenDLP is free. Varonis is enterprise-priced and not realistic for SMBs under 50 employees.

4. Access Controls That Actually Work

Access control failures are behind most breaches — not exotic exploits, but overprivileged accounts, stale credentials, and no monitoring. The CIS Controls v8 explicitly lists "Controlled Access" as a foundational safeguard.

Implement these this week:

  • Enforce MFA everywhere. Not just email — VPN, admin panels, cloud consoles, SSH. Use a phishing-resistant method where possible: FIDO2 keys (YubiKey, ~$55 each) or authenticator apps as a minimum. SMS-based MFA is better than nothing but vulnerable to SIM swaps.
  • Adopt least-privilege access. Audit who has admin rights. Remove local admin from standard user accounts. Use just-in-time (JIT) privileged access for IT tasks. Azure AD / Entra ID Privileged Identity Management handles this for Microsoft shops.
  • Review and revoke stale accounts quarterly. Disable accounts within 24 hours of employee departure. Former employees' active credentials are a quiet, common attack vector.
  • Implement role-based access control (RBAC). Define roles (finance, engineering, sales, admin) and assign permissions by role — not by individual. This makes onboarding, offboarding, and auditing dramatically simpler.

Cost estimate: $0–$150/month. YubiKeys are a one-time ~$55/user purchase. Entra ID P2 (for PIM) is $9/user/month. Many SMBs can start with free tiers of Tailscale (which includes RBAC) and built-in MFA in their existing platforms.

Quick-Win Checklist: What to Do This Week

Day Action
Monday Enable BitLocker on all Windows laptops. Install VeraCrypt on machines without BitLocker support.
Tuesday Configure local backups to a NAS using Veeam Free or rsync. Sign up for Backblaze B2 and configure off-site backup jobs.
Wednesday Enable Microsoft Purview DLP policies for credit card and SSN patterns in email and SharePoint. Block USB mass storage via Group Policy.
Thursday Enforce MFA on all accounts. Remove local admin rights from non-IT workstations. Audit and disable stale user accounts.
Friday Run a test restore from both local and cloud backups. Document the results. Review OAuth grants to third-party AI tools.

FAQ

Q: Is encryption enough to protect against ransomware? A: No. Encryption protects data at rest and in transit, but ransomware encrypts your files with the attacker's key — your disk-level encryption doesn't prevent that. You need verified offline backups (the 3-2-1 rule) for ransomware recovery. Encryption prevents the attacker from reading your data if they exfiltrate it, which is a different threat.

Q: We're a 15-person company. Do we really need DLP? A: Yes, but start small. If you have Microsoft 365 Business Premium, enable the built-in DLP rules for sensitive data patterns — it takes 30 minutes and costs nothing extra. Block USB storage on workstations. Review which AI tools have access to your data. These three steps cover the most common exfiltration vectors for small teams.

Q: How do we verify backup integrity without a full disaster recovery drill? A: Pick five random files from last week's backup. Restore them to a test location. Open each file and confirm the content is intact. Record the date, files tested, and results. This takes 15 minutes and gives you confidence your backups are functional. Veeam's SureBackup automates this if you're using their platform.

Q: What if we can't afford enterprise tools like Varonis? A: Most SMBs don't need Varonis. Microsoft Purview DLP (included in Business Premium), OpenDLP for scanning, and manual data classification in a spreadsheet will get you 80% of the value for a fraction of the cost. Invest in enterprise tools when you cross 100+ employees or handle regulated data at scale.

Conclusion

The breaches in this week's news — 2.6 million DentaQuest records, 600,000 WFP households, credit card data stolen through Stripe's own infrastructure — all exploited gaps that basic data protection controls would have mitigated. Encryption renders stolen data useless. Verified backups neutralize ransomware. DLP policies catch data exfiltration before it succeeds. Access controls limit blast radius when credentials are compromised.

You do not need a six-figure security program to get started. Enable BitLocker, configure a 3-2-1 backup with Backblaze B2, turn on the DLP rules you already pay for in Microsoft 365, and enforce MFA on every account. That is a credible data protection posture built in a single week.

Ready to go deeper? Visit consult.lil.business for a free cybersecurity assessment tailored to your business size and industry.

References

  1. NIST SP 800-111: Guide to Storage Encryption Technologies for End User Devices
  2. ACSC Guidance: Backups — Australian Cyber Security Centre
  3. CIS Controls v8: Safeguards for Data Protection
  4. BleepingComputer: DentaQuest Data Breach Exposes 2.6 Million Accounts
  5. CyberScoop: Your AI Agent Could Become Your Biggest Insider Threat

TL;DR

  • Some bad people use AI to pretend to be computer workers and get hired by companies
  • They use robot voices, fake photos, and computer-generated resumes
  • They don't actually do the work—they steal secrets
  • Companies need new ways to check if people are who they say they are

What's Happening?

Imagine this: Someone sends a job application to a company. They have a nice photo, a good resume, and they do great in the interview. The company hires them.

But there's a problem: That person doesn't really exist.

A group of bad people used AI (artificial intelligence) to create a fake person, trick the company, and get hired. Then they use their job to steal secrets and money.

This is happening RIGHT NOW with computer programming jobs.

Who's Doing This?

Microsoft (a really big computer company) found out that some people from North Korea are doing this [1]. They use special names:

  • Jasper Sleet
  • Coral Sleet (used to be called Storm-1877)

They're like teams of tricksters using computers to fake being workers.

How Do They Trick Companies?

Step 1: Creating a Fake Person

They use AI to make everything up:

  • Fake names - The computer suggests names that sound real
  • Fake photos - Computer-generated pictures that look like real people
  • Fake resumes - Computer-written work history that looks perfect for the job
  • Fake emails - Email addresses that match the fake name

It's like playing dress-up, but with computers instead of clothes.

Step 2: Tricking the Interview

When it's time for a video call, they use special tricks:

  • Robot voices - Computers that change their voice to sound like someone else
  • Chat helper - AI that helps them answer questions during the interview
  • Maybe pre-recorded videos - Sometimes they just play a video instead of talking live

The company thinks they're talking to a real person. But they're actually talking to a trickster using computer tools.

Step 3: Getting Hired (and Stealing)

Once they're "hired":

  • They get paid salary money (which goes to the bad people)
  • ️ They get access to company computers and secrets
  • They steal important information
  • They sell passwords or secrets to other bad people

They might do a little work—using AI to help them write computer code so they don't get caught. But the real goal is stealing, not working. [1]

Why Can't Companies Tell They're Fake?

Good question! Here's why regular background checks don't work:

  • Background check passes - Fake people have no criminal history because they don't exist!
  • References check - Fake references from computer-made people
  • Skills test passes - AI helps them answer technical questions
  • Looks normal on video - Computer voices and fake photos look real

It's like a really, really good costume.

Signs Someone Might Be Fake

Microsoft found some clues that can give away fake workers [1]:

Weird Things in Their Computer Code

  • Using emojis as checkmarks () inside code
  • Writing comments that sound like they're explaining themselves too much
  • Using way too many complicated words for simple things
  • Code that's more complicated than it needs to be

Weird Things About Their "Life"

  • Hardly any photos or posts on social media before a certain date
  • The same face shows up with slightly different names
  • Jobs or schools that are hard to check really exist
  • Generic stories that could be about anyone

Weird Things When Working

  • Working at strange hours
  • Asking for access to things they don't really need
  • Moving files around for no clear reason
  • Doing very little real work

How Companies Can Stay Safe

Good companies are fighting back with new rules:

Better Checking

  • Multiple video calls - Not just one interview, but lots of talking
  • Real work tests - Watch them actually do work, not just answer questions
  • Meeting in person - Sometimes you just have to see someone face-to-face
  • Checking their whole internet life - Seeing if they exist in more than one place online

Watching for Weird Stuff

  • Strange computer access - Looking at files they shouldn't need
  • Weird hours - Working at 3am when nobody else is awake
  • Moving data around - Sending files to places they shouldn't go

Being Extra Careful

  • Not giving too much power - Only giving access to what they really need
  • Checking on contractors too - Not just full-time workers, but anyone with access
  • Using computers to watch computers - AI helpers that look for fake workers

What Does This Mean for Us?

This might sound scary, but here's the good news:

Smart people are figuring this out - Companies like Microsoft are finding these tricks Better rules are being made - New ways to check if people are real Good AI is fighting bad AI - Using computer helpers to catch the tricksters

And for us regular people:

  • Learn about internet safety - Knowing tricks helps you avoid them
  • Build real relationships - Fake people can't do friendship or teamwork well
  • Ask questions - If something seems weird, it's okay to ask why

FAQ for Curious Kids

They try! But the fake people are really good at tricking. It's like when someone wears a really good Halloween costume—you can't tell who's underneath until they take it off.

Yes! Microsoft found thousands of fake accounts and stopped them [1]. But the bad people keep trying new tricks.

Maybe. That's why companies are being extra careful now. It's like locking doors—not because you expect burglars, but because you want to be safe.

No, AI is just a tool. Think of it like a hammer. You can use a hammer to build a birdhouse OR break a window. AI can help bad people do bad things, but it also helps good people catch them!

TELL A GROWNUP. Don't try to figure it out yourself. If someone online seems weird or too good to be true, that's a grownup problem to solve.

Remember

The internet has good people and bad people, just like the real world. The difference is:

  • Real world - You can see people's faces
  • Online world - People can hide who they really are

That's why we need to be extra careful and use smart rules to stay safe. ️

Want to learn more about staying safe online? Ask your parents or teachers about internet safety, or check out resources from CISA—they're the experts on keeping computers safe!

Sources

  1. Microsoft Security Blog. "AI as tradecraft: How threat actors operationalize AI." https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/

  2. Microsoft Security Blog. "Jasper Sleet: North Korean remote IT workers' evolving tactics to infiltrate organizations." https://www.microsoft.com/security/blog/2025/06/30/jasper-sleet-north-korean-remote-it-workers-evolving-tactics-to-infiltrate-organizations/

  3. CISA. "Cybersecurity for Kids." https://www.cisa.gov/news-events/news/cisa-launches-cybersecurity-awareness-month-kids

  4. FBI. "North Korean IT Workers Warning." https://www.fbi.gov/ic3/alertr/north-korean

Ready to strengthen your security?

Talk to lilMONSTER. We assess your risks, build the tools, and stay with you after the engagement ends. No clipboard-and-leave consulting.

Get a Free Consultation