Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

More Data Breaches, Fewer Details For Victims

The number of hack attacks that result in breaches has increased, but businesses are releasing less information about what was stolen--or who's at fault.

Data breach transparency is in decline. Indeed, while businesses continue to experience large numbers of data breaches, the amount of information they divulge about those breaches has been decreasing.

That revelation comes via new research conducted by the Identity Theft Resource Center (ITRC), which tracks publicly disclosed data breaches. According to the ITRC's review of the 213 data breaches that it's recorded for the first half of 2012, 63% of breach notifications contained no details about how the breach occurred, exactly what was stolen, or who was responsible. It said that the number of data breach notifications that included no details had doubled from the same time period in 2011.

"With few exceptions, there is minimal transparency when it comes to reporting breaches," read an ITRC report. As a result, it said, "the public has no way of knowing just how minor or serious the data exposure was for any given incident." The related risks facing consumers could vary wildly--for example, a breach executed by a hacker is a much greater threat than one resulting from inadvertent employee error that may have been patched before anyone learned of it.

[ Yahoo and Formspring were targets of recent hacks, resulting in leaked passwords. Read more at Yahoo Hack Leaks 453,000 Voice Passwords. ]

According to the ITRC's research, however, hacking continues to be the leading cause of data breaches. It also found that the number of data breaches triggered by hacking attacks has continued to increase, accounting for 31% of all 2012 breaches versus 28% for the first six months of 2011. Furthermore, breaches triggered by third-party business partners doubled from the first half of 2011 to the first half of 2012, when 14% of all breaches involved third parties.

There is some good news, however: by the ITRC's count, so far this year 8.5 million records have been exposed--down from 9.5 million records in the first half of last year. The ITRC counts records that involve pieces of people's personal identifying information, including social security numbers, credit card and debit credit numbers, financial account numbers, driver's license numbers, medical insurance numbers, and similar personal or sensitive information. But for the purposes of its data-breach tracking, the ITRC doesn't count exposed passwords, usernames, or email addresses as records.

More good news is that cases of insider theft decreased from 17% to 8% for the same time period. "This could indicate that companies are getting better with internal controls and vetting of employees," said the ITRC. Likewise, the number of breaches that involved social security numbers decreased from 65% in the first half of 2011, to 45% in the first half of 2012. In the same time period, reported banking breaches also declined from 8% of all breaches to just 4%, and the proportion of breaches involving credit card or debit card data decreased from 35% to just 19%.

The ITRC's research, however, comes with a large caveat: only 37% of public breach notifications in 2012 detailed what happened or who was responsible. In other words, most businesses simply decline to provide customers with breach details, leaving them to guess how--or even if--they might be at risk.

By some measures, U.S. businesses are getting better at preventing breaches. According to research from Ponemon Institute, for example, the cost of data breaches has declined, albeit only in the United States. That speaks to U.S. businesses having put more mature information security programs, as well as data breach response plans, in place.

Data breaches, however, are still quite widespread. Beyond the efforts of organized criminal gangs seeking identity theft ammunition, thank the efforts of Anonymous and other hacktivist groups, who helpfully announce their exploits when releasing leaked related data. Hacktivist-hit organizations have included everyone from the Sony PlayStation Network and Syrian government to the Justice Department and Yahoo.

But many data breaches--besides not being reported by businesses--may never even get spotted. Recently spotted breaches involving LinkedIn and eHarmony, for example, only came to light after attackers uploaded related passwords to encryption-cracking forums. But neither of those businesses had apparently detected the related breaches before that happened. Likewise, Nortel suffered a 10-year breach, before it spotted and blocked the vulnerabilities exploited by attackers.

Most states do require businesses or government agencies that suffer a data breach to notify all affected state residents. While Maryland, New Hampshire, and Vermont automatically post such notifications on public state websites, most states fail to divulge this information.

Given the paltry state of information provided to consumers--the real data breach victims, given the resulting identity theft threat they often face--the ITRC called on Congress to require mandatory data breach notifications, including details. "It is clear that without a mandatory national reporting requirement, that many data breaches will continue to be unreported, or under-reported, and it would appear that the situation is growing worse," it said.

"Other than breaches reported by the media and a few progressive state websites, there continues to be little or no information available on many data breach events," said the ITRC. "The public has no way of knowing just how minor or serious the data exposure was for any given incident."

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity Dark Reading supplement shows how to strengthen them. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5521
PUBLISHED: 2020-01-27
The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2020-5522
PUBLISHED: 2020-01-27
The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2017-14806
PUBLISHED: 2020-01-27
A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Studio onsite susestudio-common version 1.3....
CVE-2017-14807
PUBLISHED: 2020-01-27
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and modification of data. This issue affects: S...
CVE-2019-6036
PUBLISHED: 2020-01-27
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.