An employee receives an email from their HR department asking them to confirm their credentials on a form. The link points to a domain that looks like the internal portal, with just one letter different. In 2024, the platform cybermalveillance.gouv.fr recorded more than 420,000 assistance requests, about a third of which were related to phishing.
Online data security is no longer based on vague principles, but on precise reflexes in response to increasingly targeted attacks.
Recommended read : Tips and Strategies to Boost Your Business Growth in 2024
Targeted phishing and massive leaks: what recent figures change
The barometer of personal data leaks conducted in partnership with the CNIL recorded 8,613 violations reported between September 2024 and September 2025, representing a 45% increase compared to the previous period. Incidents classified as “mass,” affecting more than one million people, are multiplying.
We are no longer talking about abstract risks. When a database from an operator or mutual insurance leaks, names, addresses, and social security numbers circulate on specialized forums. Each leak fuels personalized phishing campaigns: the fraudulent message contains your real name, your real address, and sometimes a contract number. The classic anti-spam filter is no longer sufficient.
See also : Discover the best tools to optimize your online architecture projects
In light of this reality, updated technical resources can be found on the security section on Tech Mafia, which details common attack mechanisms and appropriate countermeasures.
The reflex to instill in every team: systematically check the sender’s domain before clicking on a link or opening an attachment. Not the displayed name, but the full technical address. On mobile, this requires a long press on the address, a gesture that few people have.
Password manager: the only tool that lasts over time
We know the rule: a unique password per service, long and complex. In practice, a person manages between fifty and a hundred online accounts. Without a dedicated tool, we revert to variations of the same password or store them in a text file.
A password manager (KeePass, Bitwarden, 1Password) generates and stores random credentials behind a single master password. The master password is the only string to remember. The rest is encrypted locally or in a synchronized vault.
Concrete criteria for choosing a manager
- End-to-end encryption: the provider must not be able to read your passwords, even if their servers are compromised
- Multi-device compatibility: the manager must work on your desktop browser, phone, and tablet without friction
- Published security audit: prioritize solutions whose code has been audited by an independent third party, with an accessible report
Feedback varies on the choice between self-hosted and cloud solutions. For personal use, an audited cloud solution covers most needs. For a company handling sensitive data, self-hosting offers total control over the infrastructure.
Two-factor authentication: where to prioritize activation
Activating two-factor authentication (2FA) everywhere at once is the best way to not do it at all. Start with accounts whose compromise would have the most severe impact.
Main email, online banking, employer space: these three accesses concentrate the bulk of the risk. An attacker who controls your email can reset the passwords of all your other services.
SMS, app, physical key: what to choose
The SMS code remains vulnerable to SIM swapping. An authentication app like Google Authenticator or Authy generates codes locally, without using the mobile network. For the most exposed profiles (executives, system administrators), a physical FIDO2 key blocks any phishing attempt, even sophisticated ones, as it verifies the domain of the site before activating.
In practical terms, switching from SMS to an app takes less than ten minutes per account. The gain in protection is significant.
Backups and encryption of sensitive data
When ransomware encrypts a hard drive, the question is not whether to pay the ransom. The question is: do we have a recent backup, disconnected from the network, and tested?
The operational rule consists of three points:
- A local copy on an external drive disconnected after each backup, to withstand a ransomware that encrypts everything connected
- A remote copy (encrypted cloud or external server), to cover the risk of fire, theft, or hardware failure
- A restoration test at least once a quarter, because a backup that has never been restored is a backup that does not exist
Encrypting sensitive files before storing them adds a layer of protection. Tools like VeraCrypt allow you to create an encrypted volume on an external drive in just a few minutes. If the drive is stolen, the data remains unreadable without the key.
Permissions and updates: two neglected angles in daily life
Installing a flashlight app that requests access to contacts, the microphone, and geolocation is a common situation. Each permission granted is a potential attack surface.
On both Android and iOS, we can now grant temporary permissions (only during use) or revoke them app by app. A quarterly cleanup of installed permissions takes fifteen minutes and significantly reduces exposure.
Regarding updates, an unupdated device is an open door. Security patches close vulnerabilities that are actively exploited. Enabling automatic updates on all devices, including the home router, eliminates the risk of forgetting.
Online data protection relies less on knowledge of the rules than on their regular application. A configured password manager, two-factor authentication activated on three critical accounts, a tested backup: these three actions cover the majority of attack scenarios to which we are truly exposed.