If data breach reports evoke a sense of déjà vu these days, it's only because breaches have almost unfailingly kept increasing in number and becoming bigger in scope quarter after quarter, year in and year out. However, the raw numbers do not always tell the full story.

Risk Based Security's just-released data breach report for the first six months of this year reveals a total of 3,813 breaches were reported from January 1 through June 30—or on average, more than 20 of them each day.

Combined, the breaches exposed over 4.1 billion records containing Social Security numbers, bank account and payment card information, full names, birthdates, addresses, and other sensitive information. The total number of breaches in the first half of 2019 was 54% higher than during the same period last year, while the number of exposed records was 52% more than 2018.

The data shows that organizations still face too many blind spots in their security operations, says Inga Goddijn, executive vice president at Risk Based Security. "Clearly despite the increased spending, resources are still spread too thin and there are too many holes going unfilled."

While the broad breach numbers are consistent with patterns in almost every single quarter and six-month period for the past several years, Risk Based Security's data showed that some things might be changing.

For instance, fewer records were exposed in data breaches involving Social Security numbers, names, birth dates, and addresses—all critical components for identify theft—this year compared to two years ago.

Only 11% of the exposed records during the first half of 2019 were SSNs compared to 22% last year and 27% in 2017. Similarly, just 8% and 11%, respectively, of the breached records involved birth dates and addresses, compared to 13% and 22% last year.

Similarly, for all the heightened concern around breaches caused by third parties, the data shows that in the first-half of this year there were fewer of them compared to the same period over the last five years.

In the first six months of 2019, a total of 137 breaches exposed sensitive third-party data. In comparison, there were 173 such incidents during the same period last year, 151 in 2017 and 169 in 2016. The number of records exposed in the breaches involving third-party data was also less than half of last year, and about one-third that of 2017.

Big Breaches, Big Exposures

The biggest breaches in the first six months of this year included one at Verifications.Io that exposed a mind-numbing 983 million records with all sorts of sensitive information; another at First American Financial Corp that impacted 885 million records; and one at an unknown organization that leaked personally identifiable information on some 275 million Indian citizens.

Just eight such mega-breaches accounted for 3.2 billion, or 78.6%, of the total number of records that were compromised in the first half of this year. More than seven-in-10 (70.5%) of the breaches exposed email addresses, and 64.2% exposed passwords -- a sign of the high-level of attacker interest in obtaining credentials for use in future malicious activities.

There were far fewer Web breaches (162) than there were incidents of unauthorized access to systems and services by external hackers (3,128). Yet, Web breaches were responsible for more than 80%, or 3.3 billion, of the records that were exposed in the first half of 2019.

As has been the case for sometime, organizations in the healthcare, retail, finance, and IT sectors reported significantly more data breaches than firms in almost every other industry.

"Perfect security is impossible," Goddijn says. But taking a more risk-focused approach to cybersecurity can help organizations address critical gaps, she says. That includes having a good handle on your most critical assets and knowing where your sensitive data resides, Goddijn notes. "It also includes leveraging high-quality data in order to understand where the weak spots are in order to make more informed decisions about how to address those spots."

Related Content: