Some big IT security breaches since the start of the year three involving EU institutions, and two possibly affecting me serve as warning that this is the era of the professional hackers and cyber thief.When large, supposedly well-protected systems can be successfully attacked, then every business and organisation should consider themselves vulnerable. There is no skimping on spending on more protection and smarter IT security.Data theft is becoming more common TripAdvisor told me recently, in an email from its CEO informing me that “an unauthorised third party” had stolen part of the online travel company's member email list. The company shut down the vulnerability and noted that no passwords were stolen. It warned that I could receive some more spam as a result of the theft.“The reason we are going directly to you with this news is that we think it's the right thing to do,” the company's CEO said. “As a TripAdvisor member, I would want to know. Unfortunately, this sort of data theft is becoming more common across many industries, and we take it extremely seriously.”Then this week I was told by Hilton Hotels that their loyalty programme had been broken into and not to “open e-mails from senders” I didn't know.Both breaches fortunately has a very minor impact, if any, on my data. However, I would rather that such disclosures from companies become the norm, and even a legal requirement.A bigger impact was felt across Europe in January this year, when the EU had to shut down its innovative carbon trading market, which allows companies to buy and sell their carbon emissions quotas.The shutdown occurred after cyber thieves stole credits worth about $9.4 million from the Czech Republic's registry. They also broke into the EU Emissions Trading System in Austria, Poland, Greece and Estonia, raising the amount to $43 million.The Wall Street Journal said that the Czech break-in occurred after an anonymous bomb threat was made by telephone to police, claiming there were explosives at the registry's location in Prague.The building was cleared and no devices were found. During the time the register was unmonitored, its computer system was broken into and the thieves executed the illegal trades.According to other reports, the police are unlikely to catch the thieves as the money had been funnelled away through a maze of accounts. Three months later, 24 national registers have re-opened with supposedly even better security -- but how long will they be able to withstand a new onslaught? The system has an annual turnover of $127 billion.Last month, the European Commission was itself attacked. It had to fight off a sustained digital attack on its e-mail and intranet systems on the eve of a summit of EU leaders. The European Parliament's separate system also suffered a similar cyber attack, which started on 24 March.Parliament found out only after it examined its systems in the wake of the attack on the Commission. Its IT security noticed “abnormal levels of webmail activity, particularly overnight, when we wouldn't expect such activity”. Parliament had to shut down its webmail and some other external services. No one could access their accounts from outside.The lessons for all IT security experts from these incidents are: be honest with clients, have a emergency contingency plan to shut down systems in case of a staff evacuation, and continually monitor your networks.Finally, companies must keep spending to upgrade their systems and force your staff to continually follow security procedures, even annoying and mundane ones as changing their passwords.The current “LisaMoon” attack on one million website pages is more common. The hijack redirects visitors of those websites to a fraudulent software sales operation. Most security companies say such attacks happen often, and those redirected should now know better than to input their credit cards when asked to pay for security software a fake company claims they need.The attack inserted malicious code in the websites by gaining access to the servers behind them. Often, the vulnerability is due to websites not updating their backend. If you own a website and have not updated the backend in years, now is the time to do so.Send any comments to elamin.ahmed[AT]gmail.com