Why is data security so important now?

Data security is very important now because cyberattacks have become more frequent and more convincing, and the law asks more and more of companies: a single phishing email opened by one employee can bring your business to a halt and force your company to notify the authorities.

We wrote this article in May 2020, during the COVID-19 pandemic. With the news dominated by the pandemic, many cybersecurity incidents went unnoticed at the time, even though cybercriminals had stepped up their activity. Here at our helpdesk, too, client requests related to cyberattacks rose sharply in the spring of 2020; most of the incidents were phishing or pharming.

In May 2020, TechRadar reported that the threat of cyberattacks had grown significantly and that cybercriminals were registering large numbers of coronavirus-related internet domains, which they used to offer discounts and special promotions.

Since then, attacks have remained frequent and have become more sophisticated.

Phishing emails

Phishing is a technique in which an employee is tricked, by email, into revealing personal or company information or into opening an external link that contains a virus or malware. Cybercriminals still use it widely, mainly because it’s so easy to use and because many users don’t know the minimum safety measures for using email.

The UK government’s “Cyber Security Breaches Survey 2019” showed that 32% of businesses and 22% of charities had reported a cybersecurity breach or attack in the previous 12 months, and phishing was the most common type of attack: 80% of the businesses attacked and 81% of the charities attacked had encountered it.

The situation hasn’t improved. In the 2025 edition of the same survey, 43% of businesses and 30% of charities reported a breach or attack in the previous 12 months, and phishing remained the most widespread type of attack: 85% of the businesses attacked and 86% of the charities attacked had encountered it. Artificial intelligence is making phishing emails more and more convincing: they’re written without mistakes, in the recipient’s language, and can mention the real names of colleagues or suppliers.

To protect yourself, also read how to check whether an email is spam and what to do so you don’t fall prey to phishing or spearphishing attacks.

Vishing, smishing and pharming

And because new times bring new techniques, besides phishing there’s also vishing (a fraudulent message delivered by phone or voicemail), smishing (where text messages contain links to viruses or fake websites) and pharming (a method cybercriminals use to redirect you to fake websites designed to look like genuine ones). Quishing has appeared since then too: phishing through QR codes, stuck on posters or sent in emails, that lead to fake websites.

Vishing has become more dangerous with artificial intelligence, which can imitate a person’s voice and even their image. In early 2024, a Hong Kong employee of the engineering company Arup transferred about $25 million after a video conference in which the “chief financial officer” and the other “colleagues” were AI-generated fakes, as CNN reported. That’s why any request for a payment or a bank account change should be verified through another channel, for example by calling the person on a number you already know.

What does the law require of companies regarding data security?

The law requires companies to protect their data and report incidents. The GDPR, applicable since May 2018, requires any company that processes personal data to notify ANSPDCP (the Romanian data protection authority) within 72 hours of becoming aware of a data breach, if the breach puts people’s rights at risk. The NIS2 Directive (EU) 2022/2555, transposed into Romanian law by GEO 155/2024, requires entities in the sectors it covers to take security measures, including employee training and two-step verification, and to report significant incidents to DNSC (Romania’s National Cyber Security Directorate).

Preventing cyberattacks

Staff preparation and ongoing training are vital weapons in the fight against cybercrime. Training employees in security procedures, both when they’re hired and throughout their careers, is the starting point for a safe work environment. Besides training, what matters is:

• two-step verification (MFA) for email, VPN and cloud applications;
• timely updates for operating systems and applications;
• tested backups, with a copy an attacker can’t delete;
• a simple reporting rule: employees know whom to tell about a suspicious email or call, without fear of being scolded;
• an incident response plan, so everyone knows what to do if an attack succeeds.

IT security services need to be updated as often as possible, and so do the company’s data security procedures. Just as cybercriminals keep developing new attack methods, the solutions and services of the cybersecurity industry keep evolving to counter them.

Contact us to find out how we can help you with security solutions that keep your business safe in the long run. We start with a free IT audit, and if your company is covered by NIS2, we also support you with compliance.