Most SME owners assume customer data is either safe or stolen. In reality it usually leaks through a door someone left open on purpose — a shared login, a former staff member's account, a plugin nobody remembers installing. Before you buy another security tool, find out who can actually see your customers' names, phone numbers and order history right now.
Start with a one-page access list
Open a spreadsheet and write down every system that holds customer data: your website CMS, the hosting control panel, your email marketing tool, the POS, the accounting file, the shared drive. For each one, list every person who can log in, and what they can do there — view only, edit, export, delete.
This takes an afternoon and it will probably embarrass you. That is the point. Most SMEs discover three or four accounts belonging to people who left, plus a generic admin login shared by half the office.
Questions to ask about each system
- Can this account export the full customer list in one click?
- Does it still work for someone who no longer works here?
- Is the login shared between staff, freelancers or an agency?
- When was the password last changed, and is it reused elsewhere?
Cut the list down to the minimum
Give people the least access they need to do the job. A sales assistant needs to look up a customer; they do not need to export the database. A designer updating your homepage does not need your customer records at all.
Practical moves that cost nothing:
- Delete or disable accounts for anyone who has left, including freelancers and agencies whose contracts ended.
- Replace shared logins with individual accounts so every action has a name attached.
- Turn on two-factor authentication for the CMS, hosting panel and email — these three are the keys to everything else.
- Move the customer database out of any folder that is publicly reachable from the web.
- Check which plugins or apps have been granted access to your store or CRM, and revoke the ones you stopped using.
Watch the agency handover
When a web project ends, the developer often keeps an admin account "just in case". Ask for it to be removed, and confirm it in writing. If you are not sure what your current setup looks like, it is worth a short conversation about who holds admin access to your site before you change anything.
Assume the login will be phished
Access control fails most often not because of a clever hack, but because someone typed their password into a convincing page. Hong Kong's own cyber defence drills now regularly include private companies, which tells you the attackers are not only chasing banks.
Two habits reduce the damage enormously:
- Two-factor authentication everywhere. A stolen password alone then gets an attacker nowhere.
- A named person for payment and data requests. If someone emails asking for a customer list or a change of bank details, staff confirm it through a known phone number, not by replying to the email.
Make exports visible
Bulk exports are the quietest form of data loss — it can be a departing employee, a rogue plugin or an attacker who got in last month. Where your tools allow it, switch on notifications for large exports and review them weekly. If a tool cannot tell you who exported what, that itself is a reason to reconsider the tool.
Write down what happens next
You do not need a fifty-page policy. You need one page that answers: who do we tell, in what order, and within how many hours, if we think customer data has been exposed. Name the person who decides, keep a copy offline, and make sure at least two people know where it is.
Then diarise a review. Access lists rot fast — staff turn over, tools get added, passwords get shared again. A thirty-minute check every quarter, using the same spreadsheet, keeps the list honest. If you are rebuilding a site or moving hosts, build the access list into the scope of work so it is handed over properly rather than inherited by accident.
Summary
Customer data rarely escapes through a dramatic breach; it leaks through accounts nobody closed. List every system holding customer information, note who can log in and what they can export, then remove the accounts that should not exist. Turn on two-factor authentication for your CMS, hosting and email, give each person their own login, and revoke third-party access you no longer use. Add export alerts, write a one-page response plan, and review the whole list every quarter. None of this requires a budget — only the willingness to look at the list and be honest about what it shows.