Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

More Data Breaches, Fewer Details For Victims

The number of hack attacks that result in breaches has increased, but businesses are releasing less information about what was stolen--or who's at fault.

Data breach transparency is in decline. Indeed, while businesses continue to experience large numbers of data breaches, the amount of information they divulge about those breaches has been decreasing.

That revelation comes via new research conducted by the Identity Theft Resource Center (ITRC), which tracks publicly disclosed data breaches. According to the ITRC's review of the 213 data breaches that it's recorded for the first half of 2012, 63% of breach notifications contained no details about how the breach occurred, exactly what was stolen, or who was responsible. It said that the number of data breach notifications that included no details had doubled from the same time period in 2011.

"With few exceptions, there is minimal transparency when it comes to reporting breaches," read an ITRC report. As a result, it said, "the public has no way of knowing just how minor or serious the data exposure was for any given incident." The related risks facing consumers could vary wildly--for example, a breach executed by a hacker is a much greater threat than one resulting from inadvertent employee error that may have been patched before anyone learned of it.

[ Yahoo and Formspring were targets of recent hacks, resulting in leaked passwords. Read more at Yahoo Hack Leaks 453,000 Voice Passwords. ]

According to the ITRC's research, however, hacking continues to be the leading cause of data breaches. It also found that the number of data breaches triggered by hacking attacks has continued to increase, accounting for 31% of all 2012 breaches versus 28% for the first six months of 2011. Furthermore, breaches triggered by third-party business partners doubled from the first half of 2011 to the first half of 2012, when 14% of all breaches involved third parties.

There is some good news, however: by the ITRC's count, so far this year 8.5 million records have been exposed--down from 9.5 million records in the first half of last year. The ITRC counts records that involve pieces of people's personal identifying information, including social security numbers, credit card and debit credit numbers, financial account numbers, driver's license numbers, medical insurance numbers, and similar personal or sensitive information. But for the purposes of its data-breach tracking, the ITRC doesn't count exposed passwords, usernames, or email addresses as records.

More good news is that cases of insider theft decreased from 17% to 8% for the same time period. "This could indicate that companies are getting better with internal controls and vetting of employees," said the ITRC. Likewise, the number of breaches that involved social security numbers decreased from 65% in the first half of 2011, to 45% in the first half of 2012. In the same time period, reported banking breaches also declined from 8% of all breaches to just 4%, and the proportion of breaches involving credit card or debit card data decreased from 35% to just 19%.

The ITRC's research, however, comes with a large caveat: only 37% of public breach notifications in 2012 detailed what happened or who was responsible. In other words, most businesses simply decline to provide customers with breach details, leaving them to guess how--or even if--they might be at risk.

By some measures, U.S. businesses are getting better at preventing breaches. According to research from Ponemon Institute, for example, the cost of data breaches has declined, albeit only in the United States. That speaks to U.S. businesses having put more mature information security programs, as well as data breach response plans, in place.

Data breaches, however, are still quite widespread. Beyond the efforts of organized criminal gangs seeking identity theft ammunition, thank the efforts of Anonymous and other hacktivist groups, who helpfully announce their exploits when releasing leaked related data. Hacktivist-hit organizations have included everyone from the Sony PlayStation Network and Syrian government to the Justice Department and Yahoo.

But many data breaches--besides not being reported by businesses--may never even get spotted. Recently spotted breaches involving LinkedIn and eHarmony, for example, only came to light after attackers uploaded related passwords to encryption-cracking forums. But neither of those businesses had apparently detected the related breaches before that happened. Likewise, Nortel suffered a 10-year breach, before it spotted and blocked the vulnerabilities exploited by attackers.

Most states do require businesses or government agencies that suffer a data breach to notify all affected state residents. While Maryland, New Hampshire, and Vermont automatically post such notifications on public state websites, most states fail to divulge this information.

Given the paltry state of information provided to consumers--the real data breach victims, given the resulting identity theft threat they often face--the ITRC called on Congress to require mandatory data breach notifications, including details. "It is clear that without a mandatory national reporting requirement, that many data breaches will continue to be unreported, or under-reported, and it would appear that the situation is growing worse," it said.

"Other than breaches reported by the media and a few progressive state websites, there continues to be little or no information available on many data breach events," said the ITRC. "The public has no way of knowing just how minor or serious the data exposure was for any given incident."

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity Dark Reading supplement shows how to strengthen them. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...
CVE-2020-3115
PUBLISHED: 2020-01-26
A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabi...
CVE-2020-3121
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplie...
CVE-2020-3129
PUBLISHED: 2020-01-26
A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker c...
CVE-2020-3131
PUBLISHED: 2020-01-26
[CVE-2020-3131_su] A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability i...