Why Data Security Matters: Lessons from History, Cyberattacks, and Content Strategy

Lecture Report – Data Security & Protection, FH JOANNEUM

In the course Data Security & Protection at FH JOANNEUM, lecturer Takashi Linzbichler opens the session with a quote from Haruki Murakami: “I’m not crazy. The world, it is.”

The quote reflects a central message of the lecture: modern digital systems operate in complex and sometimes unpredictable ways, particularly when it comes to the handling of personal data.

The lecture explores how data security has evolved from a niche technical concern into a major societal issue. Today, personal and organizational data flows through countless digital platforms, from social media networks to corporate databases and government infrastructure. While these systems enable powerful communication and innovation, they also create vulnerabilities that can be exploited by malicious actors.

The core thesis of the lecture is that data security must be understood as a shared responsibility across digital professions. Although cybersecurity is often seen as the domain of IT departments, the decisions made by designers, developers, and content strategists all influence how data is collected, stored, and protected.

Through a series of historical examples and modern cyber incidents, the lecture demonstrates that poorly protected data can have severe consequences from individual privacy violations to large-scale disruptions of global infrastructure.

The Reality of Cyber Threats: The 2 | 180 | 2 Rule #

One of the most striking concepts introduced in the lecture is the 2 | 180 | 2 rule, which illustrates the imbalance between attackers and defenders in modern cybersecurity.

The rule describes three key statistics:

• 2 hours: the average time it takes for attackers to gain full administrative control within a network.
• 180 days: the average time it takes organizations to detect that an attack has occurred.
• 2 percent: the proportion of organizations that publicly disclose that they have been attacked.

This statistic highlights a fundamental problem in cybersecurity. Attacks can occur extremely quickly, but organizations often take months to detect them. During this period, attackers may have unrestricted access to systems and sensitive data.

For organizations that manage large volumes of digital information, such delays can have serious consequences. Attackers may extract user credentials, personal data, financial records, or proprietary business information before the breach is even discovered.

The fact that only a small proportion of organizations disclose breaches also raises concerns about transparency and accountability. If most incidents remain hidden from the public, it becomes difficult for users to fully understand the risks associated with digital platforms.

Historical Lessons: The Netherlands During World War II #

To illustrate how data can become dangerous in the wrong context, the lecture examines a historical case from World War II.

Before the German occupation in 1940, the Netherlands maintained an extensive population registry containing personal data about its citizens. The database included details such as date of birth, street address, and religious affiliation.

The registry was originally designed for administrative efficiency and social support. However, when Nazi Germany occupied the country, the database was used to identify Jewish citizens.

Because the data was highly organized and accessible, it became a powerful tool for persecution. The Netherlands ultimately experienced one of the highest rates of Jewish victims during the war.

This case demonstrates a critical principle of data protection: data collected for beneficial purposes can become harmful if political or social conditions change.

In modern digital environments, the amount of data collected about individuals is far greater than the population registries of the 1940s. As a result, the potential consequences of misuse may be even more severe.

The Anomaly Six Case: Hidden Tracking in Mobile Apps #

The lecture also examines the case of Anomaly Six, which highlights how vulnerabilities can emerge within the modern software supply chain.

Today, many applications are built using external libraries that provide pre-developed functions such as authentication, visualization, and multimedia capabilities.

While this approach increases development efficiency, it also introduces risks. Third-party libraries may contain hidden or malicious code.

In the Anomaly Six case, tracking software was embedded into several third-party libraries used in mobile apps. According to reports discussed in the lecture, this tracking functionality allowed the company to monitor the location data of more than 100 million users across over 500 applications.

Because the tracking software was disguised as standard advertising code, the apps continued to function normally, and developers were often unaware that the tracking was occurring.

This case demonstrates how complex software ecosystems can create hidden privacy risks for users. Even well-intentioned developers may unknowingly distribute applications containing invasive tracking capabilities.

For professionals working with digital platforms; including content strategists this example highlights the importance of understanding the technologies used to deliver content and collect user data.

The LinkedIn Breach: When Weak Security Damages Trust #

Another example discussed in the lecture is the LinkedIn data breach, which exposed millions of user credentials.

In 2012, hackers gained access to LinkedIn’s systems and leaked millions of passwords online. According to BBC News, at least 6.5 million hashed passwords were initially exposed, and later investigations suggested that more than 100 million accounts were affected.

The breach was particularly problematic because LinkedIn had stored passwords using outdated encryption methods and had not implemented additional security measures such as “salting,” which adds randomness to password hashes.

As a result, many passwords were relatively easy to decode once the database was leaked.

Beyond the immediate technical consequences, the breach had long-term reputational effects. Users lost trust in the platform’s ability to safeguard their personal data, and many accounts became targets for spam, phishing, and credential-based attacks.

This case illustrates a key lesson: security weaknesses in digital systems can quickly undermine brand credibility.

For organizations that rely on user engagement and digital trust, such as social networks, media platforms, and content-driven websites, protecting user data is essential for maintaining long-term relationships with audiences.

The NotPetya Cyberattack: When Malware Becomes a Weapon #

One of the most dramatic cases discussed in the lecture is the NotPetya cyberattack, which occurred in 2017.

Unlike typical ransomware attacks designed to generate profit, NotPetya was built as a destructive cyber weapon. Its malicious function focused on permanently destroying data rather than simply encrypting it for ransom.

The attack was widely attributed to the Russian hacker group “Sandworm” and was believed to be part of a political and military campaign targeting Ukrainian infrastructure.

Once deployed, the malware spread rapidly across networks using vulnerabilities in widely used software systems. The attack caused enormous global damage, with estimated losses reaching $10 billion.

Several major international companies experienced severe disruptions, including:

• Maersk shipping
• Merck pharmaceuticals
• FedEx / TNT
• Mondelez

The impact on Maersk was particularly significant. The company’s global IT infrastructure was effectively destroyed, forcing it to halt operations for approximately two weeks. During this time, roughly 18,000 container ships were unable to load or unload cargo.

Remarkably, Maersk was only able to restore its systems because a single domain controller server in Ghana had been offline during the attack and therefore remained intact.

This example demonstrates how deeply modern society depends on digital infrastructure. Cyberattacks can disrupt global logistics, financial systems, healthcare services, and communication networks.

Data Protection vs Privacy #

Another important distinction discussed in the lecture is the difference between privacy and data protection.

According to the lecture slides:

• Privacy refers to organizational and legal rules that determine who may access data and under what conditions.
• Data protection refers to the technical enforcement of those rules.

This distinction highlights a common problem in digital organizations. Companies often publish detailed privacy policies but fail to implement the technical safeguards necessary to protect user data.

Effective data governance therefore requires both clear policies and robust technical security measures.

How to Create a Secure Password #

One of the simplest but most important aspects of data security is password protection.

Weak credentials remain one of the most common causes of security breaches. Incidents such as the LinkedIn breach demonstrate how inadequate password protection can expose millions of accounts and lead to long-term security risks.

According to Google, strong passwords significantly reduce the risk of unauthorized access and help protect sensitive data such as email accounts, files, and online services.

Several principles should be followed when creating secure passwords:

Use long passwords
Passwords should contain at least 12 characters. Longer passwords are significantly harder to crack using automated tools.

Use a mix of characters
Combining uppercase letters, lowercase letters, numbers, and symbols increases password complexity.

Avoid reuse across platforms
Using the same password across multiple services increases vulnerability if one account is compromised.

Avoid personal information
Birthdays, names, and phone numbers are often easy to guess or discover.

Avoid common words or patterns
Passwords such as “password,” “1234,” or “qwerty” are among the first combinations attackers attempt.

Use password managers
Password managers allow users to generate and store complex passwords securely.

Following these practices helps protect individuals and organizations from common attack techniques such as brute-force attacks and credential stuffing.

Zero Trust: A New Approach to Cybersecurity #

The lecture concludes by introducing the concept of Zero Trust Architecture, which students are asked to research further.

Traditional security models assumed that users inside a network could generally be trusted once they had authenticated. However, many modern cyberattacks exploit this assumption by gaining access to internal systems and then moving laterally across networks.

Zero Trust challenges this approach by adopting the principle that no user or device should be trusted by default, regardless of their location.

In practice, Zero Trust involves:

• continuous authentication
• strict access control
• monitoring of system activity
• limiting user permissions to only what is necessary

By enforcing these principles, organizations can reduce the impact of stolen credentials and limit the spread of malware within networks.

Reflection: Why Data Security Matters for Content Strategy #

Although cybersecurity is often viewed as a technical field, the lecture highlights why data security is also highly relevant for professionals working in communication and content strategy.

Modern digital content ecosystems rely heavily on data collection. Content teams frequently manage systems that collect personal information through:

• newsletter subscriptions
• account registrations
• analytics tracking tools
• marketing automation platforms
• personalization technologies

As a result, content strategists influence how organizations gather and communicate about user data.

This creates several responsibilities:

• ensuring transparency about data collection practices
• choosing responsible digital tools and platforms
• protecting user trust through ethical data practices

Trust is one of the most valuable assets in digital communication. Once users believe their data is unsafe, rebuilding credibility can take years.

For this reason, data security should not be considered merely an IT concern. It is a strategic issue that affects branding, communication, and the long-term relationship between organizations and their audiences.

Where to go from here #

The Importance of Ethics in Content Strategy

References #

BBC News. (2012, June 6). LinkedIn confirms password breach.
https://www.bbc.com/news/technology-18338956

Greenberg, A. (2018). The untold story of NotPetya, the most devastating cyberattack in history. Wired.
https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world

Google. (n.d.). Create a strong password & a more secure account. Google Account Help.
https://support.google.com/accounts/answer/32040

Laiho, S. (n.d.). Sami Laiho. Retrieved March 29, 2026, from https://samilaiho.com/

Linzbichler, T. (2026). Data Security & Protection – COS24 Summer Term 2026 lecture slides. FH JOANNEUM.