Attacks/Breaches
7/13/2012
09:39 AM
50%
50%

More Data Breaches, Fewer Details For Victims

The number of hack attacks that result in breaches has increased, but businesses are releasing less information about what was stolen--or who's at fault.

Data breach transparency is in decline. Indeed, while businesses continue to experience large numbers of data breaches, the amount of information they divulge about those breaches has been decreasing.

That revelation comes via new research conducted by the Identity Theft Resource Center (ITRC), which tracks publicly disclosed data breaches. According to the ITRC's review of the 213 data breaches that it's recorded for the first half of 2012, 63% of breach notifications contained no details about how the breach occurred, exactly what was stolen, or who was responsible. It said that the number of data breach notifications that included no details had doubled from the same time period in 2011.

"With few exceptions, there is minimal transparency when it comes to reporting breaches," read an ITRC report. As a result, it said, "the public has no way of knowing just how minor or serious the data exposure was for any given incident." The related risks facing consumers could vary wildly--for example, a breach executed by a hacker is a much greater threat than one resulting from inadvertent employee error that may have been patched before anyone learned of it.

[ Yahoo and Formspring were targets of recent hacks, resulting in leaked passwords. Read more at Yahoo Hack Leaks 453,000 Voice Passwords. ]

According to the ITRC's research, however, hacking continues to be the leading cause of data breaches. It also found that the number of data breaches triggered by hacking attacks has continued to increase, accounting for 31% of all 2012 breaches versus 28% for the first six months of 2011. Furthermore, breaches triggered by third-party business partners doubled from the first half of 2011 to the first half of 2012, when 14% of all breaches involved third parties.

There is some good news, however: by the ITRC's count, so far this year 8.5 million records have been exposed--down from 9.5 million records in the first half of last year. The ITRC counts records that involve pieces of people's personal identifying information, including social security numbers, credit card and debit credit numbers, financial account numbers, driver's license numbers, medical insurance numbers, and similar personal or sensitive information. But for the purposes of its data-breach tracking, the ITRC doesn't count exposed passwords, usernames, or email addresses as records.

More good news is that cases of insider theft decreased from 17% to 8% for the same time period. "This could indicate that companies are getting better with internal controls and vetting of employees," said the ITRC. Likewise, the number of breaches that involved social security numbers decreased from 65% in the first half of 2011, to 45% in the first half of 2012. In the same time period, reported banking breaches also declined from 8% of all breaches to just 4%, and the proportion of breaches involving credit card or debit card data decreased from 35% to just 19%.

The ITRC's research, however, comes with a large caveat: only 37% of public breach notifications in 2012 detailed what happened or who was responsible. In other words, most businesses simply decline to provide customers with breach details, leaving them to guess how--or even if--they might be at risk.

By some measures, U.S. businesses are getting better at preventing breaches. According to research from Ponemon Institute, for example, the cost of data breaches has declined, albeit only in the United States. That speaks to U.S. businesses having put more mature information security programs, as well as data breach response plans, in place.

Data breaches, however, are still quite widespread. Beyond the efforts of organized criminal gangs seeking identity theft ammunition, thank the efforts of Anonymous and other hacktivist groups, who helpfully announce their exploits when releasing leaked related data. Hacktivist-hit organizations have included everyone from the Sony PlayStation Network and Syrian government to the Justice Department and Yahoo.

But many data breaches--besides not being reported by businesses--may never even get spotted. Recently spotted breaches involving LinkedIn and eHarmony, for example, only came to light after attackers uploaded related passwords to encryption-cracking forums. But neither of those businesses had apparently detected the related breaches before that happened. Likewise, Nortel suffered a 10-year breach, before it spotted and blocked the vulnerabilities exploited by attackers.

Most states do require businesses or government agencies that suffer a data breach to notify all affected state residents. While Maryland, New Hampshire, and Vermont automatically post such notifications on public state websites, most states fail to divulge this information.

Given the paltry state of information provided to consumers--the real data breach victims, given the resulting identity theft threat they often face--the ITRC called on Congress to require mandatory data breach notifications, including details. "It is clear that without a mandatory national reporting requirement, that many data breaches will continue to be unreported, or under-reported, and it would appear that the situation is growing worse," it said.

"Other than breaches reported by the media and a few progressive state websites, there continues to be little or no information available on many data breach events," said the ITRC. "The public has no way of knowing just how minor or serious the data exposure was for any given incident."

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity Dark Reading supplement shows how to strengthen them. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.