Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

More Data Breaches, Fewer Details For Victims

The number of hack attacks that result in breaches has increased, but businesses are releasing less information about what was stolen--or who's at fault.

Data breach transparency is in decline. Indeed, while businesses continue to experience large numbers of data breaches, the amount of information they divulge about those breaches has been decreasing.

That revelation comes via new research conducted by the Identity Theft Resource Center (ITRC), which tracks publicly disclosed data breaches. According to the ITRC's review of the 213 data breaches that it's recorded for the first half of 2012, 63% of breach notifications contained no details about how the breach occurred, exactly what was stolen, or who was responsible. It said that the number of data breach notifications that included no details had doubled from the same time period in 2011.

"With few exceptions, there is minimal transparency when it comes to reporting breaches," read an ITRC report. As a result, it said, "the public has no way of knowing just how minor or serious the data exposure was for any given incident." The related risks facing consumers could vary wildly--for example, a breach executed by a hacker is a much greater threat than one resulting from inadvertent employee error that may have been patched before anyone learned of it.

[ Yahoo and Formspring were targets of recent hacks, resulting in leaked passwords. Read more at Yahoo Hack Leaks 453,000 Voice Passwords. ]

According to the ITRC's research, however, hacking continues to be the leading cause of data breaches. It also found that the number of data breaches triggered by hacking attacks has continued to increase, accounting for 31% of all 2012 breaches versus 28% for the first six months of 2011. Furthermore, breaches triggered by third-party business partners doubled from the first half of 2011 to the first half of 2012, when 14% of all breaches involved third parties.

There is some good news, however: by the ITRC's count, so far this year 8.5 million records have been exposed--down from 9.5 million records in the first half of last year. The ITRC counts records that involve pieces of people's personal identifying information, including social security numbers, credit card and debit credit numbers, financial account numbers, driver's license numbers, medical insurance numbers, and similar personal or sensitive information. But for the purposes of its data-breach tracking, the ITRC doesn't count exposed passwords, usernames, or email addresses as records.

More good news is that cases of insider theft decreased from 17% to 8% for the same time period. "This could indicate that companies are getting better with internal controls and vetting of employees," said the ITRC. Likewise, the number of breaches that involved social security numbers decreased from 65% in the first half of 2011, to 45% in the first half of 2012. In the same time period, reported banking breaches also declined from 8% of all breaches to just 4%, and the proportion of breaches involving credit card or debit card data decreased from 35% to just 19%.

The ITRC's research, however, comes with a large caveat: only 37% of public breach notifications in 2012 detailed what happened or who was responsible. In other words, most businesses simply decline to provide customers with breach details, leaving them to guess how--or even if--they might be at risk.

By some measures, U.S. businesses are getting better at preventing breaches. According to research from Ponemon Institute, for example, the cost of data breaches has declined, albeit only in the United States. That speaks to U.S. businesses having put more mature information security programs, as well as data breach response plans, in place.

Data breaches, however, are still quite widespread. Beyond the efforts of organized criminal gangs seeking identity theft ammunition, thank the efforts of Anonymous and other hacktivist groups, who helpfully announce their exploits when releasing leaked related data. Hacktivist-hit organizations have included everyone from the Sony PlayStation Network and Syrian government to the Justice Department and Yahoo.

But many data breaches--besides not being reported by businesses--may never even get spotted. Recently spotted breaches involving LinkedIn and eHarmony, for example, only came to light after attackers uploaded related passwords to encryption-cracking forums. But neither of those businesses had apparently detected the related breaches before that happened. Likewise, Nortel suffered a 10-year breach, before it spotted and blocked the vulnerabilities exploited by attackers.

Most states do require businesses or government agencies that suffer a data breach to notify all affected state residents. While Maryland, New Hampshire, and Vermont automatically post such notifications on public state websites, most states fail to divulge this information.

Given the paltry state of information provided to consumers--the real data breach victims, given the resulting identity theft threat they often face--the ITRC called on Congress to require mandatory data breach notifications, including details. "It is clear that without a mandatory national reporting requirement, that many data breaches will continue to be unreported, or under-reported, and it would appear that the situation is growing worse," it said.

"Other than breaches reported by the media and a few progressive state websites, there continues to be little or no information available on many data breach events," said the ITRC. "The public has no way of knowing just how minor or serious the data exposure was for any given incident."

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity Dark Reading supplement shows how to strengthen them. (Free registration required.)

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11937
PUBLISHED: 2020-08-06
In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.
CVE-2020-15114
PUBLISHED: 2020-08-06
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting i...
CVE-2020-15136
PUBLISHED: 2020-08-06
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints func...
CVE-2020-15701
PUBLISHED: 2020-08-06
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.1...
CVE-2020-15702
PUBLISHED: 2020-08-06
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges....