When we see headlines about data breaches, they are often about big, corporate entities, in which hundreds of thousands, or even millions of personal identities and financial profiles have been exposed. According to Symantec, the number of publicly disclosed data breaches continues to rise. But these “mega breaches” aren’t the only thing security experts are worried about. There is also the specter of small,unreported data breaches.

Small- and medium-sized companies are also at high risk of data breaches. While the payoff to cybercriminals may be smaller, they are still tempting targets because their security is usually less robust than an enterprise’s. It is likely that with all the mega-breaches occurring, far more small-scale breaches are going unreported. A business owner may not realize they’ve been hacked, or may feel embarrassed that they have been targeted. For many, it may simply be that they don’t know what to do when they’ve been attacked.

There are many ways that small businesses can protect their data, and we’ll continue to promote thesepreventive measures whenever we can. But those that aren’t taking these precautions are opening themselves up to attacks needlessly. Victims are often bewildered in the wake of a data breach; this isn’t a daily occurrence for most people. Fortunately, there are experts who deal with these issues regularly, which is why every small-business owner should at least be aware of the incident response industry.

Incident response services help their clients recover as quickly as possible from data breaches. They identify what data has been exposed, collect and preserve evidence for the investigation, and then secure systems from future attacks. Whereas a small organization may not be able to retain a full-time team to proactively maintain a secure IT infrastructure, incident response services can be brought on reactively, as needed. Fortunately, there are many providers out there, each with their own portfolio of services, specialties, and pricing structures. Researching your options is something you ought to be doing now, rather than in the wake of a data breach, when you’ll probably have many other things on your mind.

Prevention is almost always going to be the most cost-effective solution to securing your online data. But in the constant arms race between cybersecurity and cybercriminals, even those that have protected themselves might become the target of an attack. If that ever happens to you, be sure you have a preferred incident response service in mind. It may not be a call you ever want to make, but in the flurry of activity that follows a data breach, it’s good to know that there is someone that you can call.

We’ve talked before about general tips to keep your domains and account information safe from hackers and cybercriminals, and those topics—password strength, current email, account validation—are still relevant to protect sensitive information. That said, there is still one source of personal information you may not have considered: your domains’ Whois record.

Every domain contains a Whois record, which includes information about the registrant like name, phone number, physical address, and email address. It does NOT record any financial or payment information. International rules for the governance of domain names requires that this information be collected every time a domain is registered. If you’d like to see an example, we have a Whois lookup feature to see what any domain’s record contains.

The Whois record does have a useful purpose; it gives users the ability to contact a site’s administrator with any complaints, questions, or suggestions. Some may even want their information publicly available as a form of business advertisement. But for many, the security of their information may be the overriding factor.

Even if you aren’t worried about identity thieves, there’s another reason you may want this information kept private. Direct mail and telemarketing firms sometimes use information from Whois records to add to their contact lists. If you’re getting direct mail, spam email, or intrusive text messages or calls, some of that may have originated from your domain’s Whois record.

Fortunately, all of these above effects have an easy solution that we call ID Protect. For a nominal fee, this annually-renewable service effectively hides any personal, identifying information about you, the registrant, and replaces it with general contact information for us, the registrar. Any inquiries made about your domain are forwarded to you, without any of your information being revealed to third parties.

Note that not all domain extensions can be protected by ID Protect because some registries require the information to be collected and made available. But many of the most popular TLDs qualify. So how do you check the status of your domains?

Checking and Adding ID Protect

Log in to your account dashboard and click on the “Manage Domains” link. You should see a list of your domains, with several columns to the right of each one.

In the ID Protect column, you’ll see various icons indicating the domain’s status whether it’s already covered by ID protect (green shield), not currently covered (red silhouette), or does not qualify (N/A symbol). If you would like to add ID protect to a domain, check the box to the left of the domain, and click on the drop-down menu labeled “LIST ACTIONS” in the lower-left corner.

Scroll down to “Add ID Protect” and then hit the “Go” button. Follow the onscreen instructions to complete the purchase of this service.

Who to ask for help?

As easy as adding ID Protect can be, it never hurts to ask for help, that’s why we offer several ways to get it. You can go to our Help Center, read the ID Protect FAQ, or call us at (425)-974-4689. When you’re ready,add ID Protect to all of your domains.