Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

More Data Breaches, Fewer Details For Victims

The number of hack attacks that result in breaches has increased, but businesses are releasing less information about what was stolen--or who's at fault.

Data breach transparency is in decline. Indeed, while businesses continue to experience large numbers of data breaches, the amount of information they divulge about those breaches has been decreasing.

That revelation comes via new research conducted by the Identity Theft Resource Center (ITRC), which tracks publicly disclosed data breaches. According to the ITRC's review of the 213 data breaches that it's recorded for the first half of 2012, 63% of breach notifications contained no details about how the breach occurred, exactly what was stolen, or who was responsible. It said that the number of data breach notifications that included no details had doubled from the same time period in 2011.

"With few exceptions, there is minimal transparency when it comes to reporting breaches," read an ITRC report. As a result, it said, "the public has no way of knowing just how minor or serious the data exposure was for any given incident." The related risks facing consumers could vary wildly--for example, a breach executed by a hacker is a much greater threat than one resulting from inadvertent employee error that may have been patched before anyone learned of it.

[ Yahoo and Formspring were targets of recent hacks, resulting in leaked passwords. Read more at Yahoo Hack Leaks 453,000 Voice Passwords. ]

According to the ITRC's research, however, hacking continues to be the leading cause of data breaches. It also found that the number of data breaches triggered by hacking attacks has continued to increase, accounting for 31% of all 2012 breaches versus 28% for the first six months of 2011. Furthermore, breaches triggered by third-party business partners doubled from the first half of 2011 to the first half of 2012, when 14% of all breaches involved third parties.

There is some good news, however: by the ITRC's count, so far this year 8.5 million records have been exposed--down from 9.5 million records in the first half of last year. The ITRC counts records that involve pieces of people's personal identifying information, including social security numbers, credit card and debit credit numbers, financial account numbers, driver's license numbers, medical insurance numbers, and similar personal or sensitive information. But for the purposes of its data-breach tracking, the ITRC doesn't count exposed passwords, usernames, or email addresses as records.

More good news is that cases of insider theft decreased from 17% to 8% for the same time period. "This could indicate that companies are getting better with internal controls and vetting of employees," said the ITRC. Likewise, the number of breaches that involved social security numbers decreased from 65% in the first half of 2011, to 45% in the first half of 2012. In the same time period, reported banking breaches also declined from 8% of all breaches to just 4%, and the proportion of breaches involving credit card or debit card data decreased from 35% to just 19%.

The ITRC's research, however, comes with a large caveat: only 37% of public breach notifications in 2012 detailed what happened or who was responsible. In other words, most businesses simply decline to provide customers with breach details, leaving them to guess how--or even if--they might be at risk.

By some measures, U.S. businesses are getting better at preventing breaches. According to research from Ponemon Institute, for example, the cost of data breaches has declined, albeit only in the United States. That speaks to U.S. businesses having put more mature information security programs, as well as data breach response plans, in place.

Data breaches, however, are still quite widespread. Beyond the efforts of organized criminal gangs seeking identity theft ammunition, thank the efforts of Anonymous and other hacktivist groups, who helpfully announce their exploits when releasing leaked related data. Hacktivist-hit organizations have included everyone from the Sony PlayStation Network and Syrian government to the Justice Department and Yahoo.

But many data breaches--besides not being reported by businesses--may never even get spotted. Recently spotted breaches involving LinkedIn and eHarmony, for example, only came to light after attackers uploaded related passwords to encryption-cracking forums. But neither of those businesses had apparently detected the related breaches before that happened. Likewise, Nortel suffered a 10-year breach, before it spotted and blocked the vulnerabilities exploited by attackers.

Most states do require businesses or government agencies that suffer a data breach to notify all affected state residents. While Maryland, New Hampshire, and Vermont automatically post such notifications on public state websites, most states fail to divulge this information.

Given the paltry state of information provided to consumers--the real data breach victims, given the resulting identity theft threat they often face--the ITRC called on Congress to require mandatory data breach notifications, including details. "It is clear that without a mandatory national reporting requirement, that many data breaches will continue to be unreported, or under-reported, and it would appear that the situation is growing worse," it said.

"Other than breaches reported by the media and a few progressive state websites, there continues to be little or no information available on many data breach events," said the ITRC. "The public has no way of knowing just how minor or serious the data exposure was for any given incident."

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity Dark Reading supplement shows how to strengthen them. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18898
PUBLISHED: 2020-01-23
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE SUSE Linux Enterprise Server 15 SP1 trousers versions prior to 0.3.14...
CVE-2019-19837
PUBLISHED: 2020-01-23
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote information disclosure of bin/web.conf via HTTP requests.
CVE-2020-7210
PUBLISHED: 2020-01-23
Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.
CVE-2019-19835
PUBLISHED: 2020-01-23
SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of service via the server attribute to the tools/_rcmdstat.jsp URI.
CVE-2020-5216
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seei...