Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Hacking Becomes Leading Cause Of Data Breaches

Businesses are the main target, and lost data is rarely password-protected or encrypted, according to a report from the Identity Theft Resource Center.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The Identity Theft Resource Center (ITRC) announced on Tuesday that hacking has overtaken malicious insiders to become the leading cause of data breaches. Furthermore, successful attacks against businesses--as opposed to financial services groups, the government, medical sector, or education--have been on the rise, and now account for half of all 2011 data breaches.

Those findings come from the ITRC's analysis of data breaches from the start of January 2011 until April 5, 2011. During that period, the ITRC counted 130 breaches, exposing a total of 9.5 million records.

All told, nearly 37% of those breaches resulted from malicious attacks targeting computer systems, which is double the rate of 17% seen by the ITRC for all of 2010, which suggests that these types of attacks are intensifying. In addition, 12% of breaches for which the cause of data leakage was known were due to malicious insiders. As a result, that means that nearly half of all publicly known breaches resulted from targeted attacks.

Another finding is that more than one-third of all records lost due to 2011 data breaches were medical records. In March, for example, IBM informed Health Net that it couldn't locate multiple drives, previously stored in one of its data centers, which together contained 1.9 million people's medical records, including--potentially--their names, addresses, social security numbers, and financial information. Also that month, a thief stole a computer from the Eisenhower Medical Center in California that contained up to 500,000 medical records, including people's names.

The issue of lost records is not academic, or a problem experienced solely by consumers who see their personal details go missing, exposing them to identity theft. In fact, a study from 2010 found that the leading result of data breaches is business downtime. Needless to say, when employees can't access network-based resources, productivity--and profits--suffer.

Another disturbing finding is that lost data of a sensitive nature rarely seems to be protected. According to the ITRC, just 1% of lost data in 2011 was secured using encryption, and only 5% was password protected.

Some of the ITRC's findings contrast with recent studies, such as the 2011 Data Breach Investigations Report from Verizon Business, which looked at 800 cases in 2010 and had access to investigatory information from Secret Service and Dutch computer crime police cases. The report found that 92% of data breaches involved external people, while 17% involved insiders. It also found that 361 million records were compromised in 2008, while only 4 million had been compromised in 2010.

In a phone interview, ITRC founder and data breach report author Linda Foley said that she's careful to distinguish ITRC's findings from other data breach reports. "We don't have access to the Secret Service's data," she said.

As a result, groups such as the ITRC rely on statements released by breached companies, or reliable news reports. Data breach notification letters, which inform state residents when their information may have been compromised, are another source of information, and about 15 states now require such notifications. But just three states--Maryland, New Hampshire and Vermont--automatically post these data breach notifications to a public website.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-35419
PUBLISHED: 2021-04-14
Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.
CVE-2021-28060
PUBLISHED: 2021-04-14
A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.
CVE-2021-28825
PUBLISHED: 2021-04-14
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker with l...
CVE-2021-28826
PUBLISHED: 2021-04-14
The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Community Edition and TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge - Enterprise Edition contains a vulnerability that theoretically allows a low privileged attacker wi...
CVE-2021-28855
PUBLISHED: 2021-04-14
In Deark before 1.5.8, a specially crafted input file can cause a NULL pointer dereference in the dbuf_write function (src/deark-dbuf.c).