It recently came out that someone downloaded the names and addresses of 42,370 Norwegian Ikea customers, plus information about just over 3,000 employees. The way in was not through Ikea's own code. It went through a security hole in software written by someone else.

What actually happened

On 19 March, attackers got into the development environment where Ikea keeps code and data. The entry point was a security hole in open-source software used by their data processor. The attack went on for several days, and the attackers managed to copy several datasets before anyone noticed.

In total, around 45,000 people in Norway are affected. Ikea says the dataset contains duplicates and some fictional entries, so the real number is probably lower. The case has been reported to the data protection authorities in Norway, Sweden and the Netherlands, with the Swedish authority leading the investigation. Ikea still doesn't know who was behind it.

None of the leaked information counts as sensitive. That doesn't make it harmless. A name, an address and the knowledge that you shop at Ikea is all a scammer needs to write a convincing email about a delivery waiting for you. The more real details, the more people click.

The hole wasn't Ikea's own

Here is the point that matters most if you run a small business. Ikea has its own IT company and security people on duty around the clock. They still got caught, not through something they built themselves, but through a component they brought in from outside.

Your website is built exactly the same way. A typical WordPress site runs 20 to 30 plugins written by people you have never met. Booking, contact forms, analytics, image galleries. Every one of them is a door in, and you don't hold the key to any of them.

The difference between you and Ikea is not that you are a less interesting target. Automated attacks don't care about size, they scan everything. The difference is that Ikea noticed the break-in, reported it and told people. Most small businesses have no one watching at all.

The responsibility is yours either way

This surprises a lot of people: it doesn't matter that the flaw was in a supplier's software. If the data belongs to your customers, your business is the one responsible under GDPR. If your booking system or form provider leaks, you are the one who has to notify the data protection authority within 72 hours, and you are the one who has to tell your customers if the risk is high.

That is worth knowing before it happens, not after. Ikea handled this part well: they noticed, reported and notified. That is the part of the story worth copying.

Data you don't have can't leak

The best defence is boring: store less. Plenty of websites are sitting on form submissions from years back, old exports of customer lists and mailing lists nobody uses. All of it just sits there waiting to become a problem, doing no good for anyone.

That is one of the reasons we build websites that store as little personal data as possible in the site itself. If something does happen, there is almost nothing to take. It isn't advanced security, it's just tidiness made into a system.

Three things you can do today

  • Write down what personal data your website actually stores, and where. Form submissions, orders, mailing lists, comments. If you don't know, that answer should worry you more than anything else.
  • Delete what you don't need. Old submissions, unused lists, customer data from systems you stopped using.
  • Update everything, and remove plugins you don't use. Most break-ins at small businesses happen through known holes in outdated software, not through brilliant hacking.

All of this is free and takes an afternoon. And if you are wondering what your website actually stores and how exposed it is, you can send us the address. We'll take a look and give you honest answers, free and with no strings attached.