Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/15/2016
09:00 AM
Jai Vijayan
Jai Vijayan
Slideshows
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

The 7 Most Significant Government Data Breaches

Mega compromises at federal and state agencies over the past three years has compromised everything from personal data on millions to national security secrets.
Previous
1 of 8
Next

Data maintained by Privacy Rights Clearinghouse shows that federal and state government agencies publicly disclosed a total of 203 data breaches over the past five years.

In all, the breaches resulted in nearly 47 million records being stolen, exposed or otherwise compromised. The number of breached records does not include the numerous cases where agencies either did not disclose the scope of their data breach or the actual number of records that might have been involved.

It also does not include data from incidents like Edward Snowden’s theft of classified documents from the National Security Agency (NSA) or the recently disclosed theft of 50 TB of government data by another former contractor for the NSA and other federal agencies.

In terms of raw numbers, federal and state government agencies suffereda lot fewer breaches and exposed fewer data records than private companies. PRC numbers show that between 2012 and 2016 for instance, financial and insurance companies, retailers, and other businesses disclosed some 950 breaches involving 244.5 million records.

What makes the government breaches more significant though is the kind of information involved. In a majority of cases, government breaches involved personally identifying data, such as names, Social Security numbers, and birthdates, the loss of which have substantially greater consequences for victims than breaches involving loss of credit card data or email account information. In a few cases, the breaches involved loss of top secret and highly confidential data of national security value.

Here, ranked in ascending order of severity, are seven of the most significant government data breaches of the past three years.

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
kbannan100
50%
50%
kbannan100,
User Rank: Moderator
11/17/2016 | 10:59:38 PM
It's going to take a village
These breaches are just the tip of the iceberg. We all know that. One of the biggest problems is the amount of unsecured endpoints that are out there. Things like printers that aren't secured and laptops that aren't running antivirus or -- if they are -- have not been patched. It's going to take a lot more work on everyone's behalf before the good guys get ahead of the criminals. 

--Karen Bannan for IDG and HP
ONI SEO
50%
50%
ONI SEO,
User Rank: Apprentice
11/18/2016 | 11:34:05 AM
Mr ROBOT comes soon?
A great post with good questions/ But how to avoid that? What kind of solutions?
ClaireEllison
50%
50%
ClaireEllison,
User Rank: Apprentice
11/21/2016 | 4:22:24 PM
Re: amazing
A great post with good questions/ But how to avoid that? I really wanted to send a small word to say thanks to you for the fantastic points you are writing on this site.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Mobile App Fraud Jumped in Q1 as Attackers Pivot from Browsers
Jai Vijayan, Contributing Writer,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20898
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.
CVE-2019-20899
PUBLISHED: 2020-07-13
The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.
CVE-2019-20900
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.
CVE-2019-20897
PUBLISHED: 2020-07-13
The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...