Hacking Becomes Leading Cause Of Data BreachesBusinesses are the main target, and lost data is rarely password-protected or encrypted, according to a report from the Identity Theft Resource Center.
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The Identity Theft Resource Center (ITRC) announced on Tuesday that hacking has overtaken malicious insiders to become the leading cause of data breaches. Furthermore, successful attacks against businesses--as opposed to financial services groups, the government, medical sector, or education--have been on the rise, and now account for half of all 2011 data breaches.
Those findings come from the ITRC's analysis of data breaches from the start of January 2011 until April 5, 2011. During that period, the ITRC counted 130 breaches, exposing a total of 9.5 million records.
All told, nearly 37% of those breaches resulted from malicious attacks targeting computer systems, which is double the rate of 17% seen by the ITRC for all of 2010, which suggests that these types of attacks are intensifying. In addition, 12% of breaches for which the cause of data leakage was known were due to malicious insiders. As a result, that means that nearly half of all publicly known breaches resulted from targeted attacks.
Another finding is that more than one-third of all records lost due to 2011 data breaches were medical records. In March, for example, IBM informed Health Net that it couldn't locate multiple drives, previously stored in one of its data centers, which together contained 1.9 million people's medical records, including--potentially--their names, addresses, social security numbers, and financial information. Also that month, a thief stole a computer from the Eisenhower Medical Center in California that contained up to 500,000 medical records, including people's names.
The issue of lost records is not academic, or a problem experienced solely by consumers who see their personal details go missing, exposing them to identity theft. In fact, a study from 2010 found that the leading result of data breaches is business downtime. Needless to say, when employees can't access network-based resources, productivity--and profits--suffer.
Another disturbing finding is that lost data of a sensitive nature rarely seems to be protected. According to the ITRC, just 1% of lost data in 2011 was secured using encryption, and only 5% was password protected.
Some of the ITRC's findings contrast with recent studies, such as the 2011 Data Breach Investigations Report from Verizon Business, which looked at 800 cases in 2010 and had access to investigatory information from Secret Service and Dutch computer crime police cases. The report found that 92% of data breaches involved external people, while 17% involved insiders. It also found that 361 million records were compromised in 2008, while only 4 million had been compromised in 2010.
In a phone interview, ITRC founder and data breach report author Linda Foley said that she's careful to distinguish ITRC's findings from other data breach reports. "We don't have access to the Secret Service's data," she said.
As a result, groups such as the ITRC rely on statements released by breached companies, or reliable news reports. Data breach notification letters, which inform state residents when their information may have been compromised, are another source of information, and about 15 states now require such notifications. But just three states--Maryland, New Hampshire and Vermont--automatically post these data breach notifications to a public website.