Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

5/8/2018
08:00 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Publicly Disclosed Breaches Down Drastically in Q1 2018

Quietest first quarter since 2012, according to new report from Risk Based Security.

The early part of 2018 has brought a spot of good news, as reports from first quarter show that the number of publicly reported breaches dropped dramatically compared to the same period of time last year.

"We haven't seen a Q1 this quiet since 2012," says Inga Goddijn, executive vice president for Risk Based Security, which today released the statistics from its Q1 2018 Data Breach Trends report

The study shows that organizations experienced 686 breaches that exposed approximately 1.4 billion records. That's nothing to sneeze at, but the good news is that compared to Q1 2017 both numbers have gone down more than half. In the first three months of 2017, the number of exposed records had already added up to 3.4 billion.

Goddijn and the Risk Based Security team are not sure exactly why the numbers have shifted lower, though they have a few theories. First of all, the number of attacks phishing for employee W-2 wage and salary data has plummeted. Last year's report saw 200 of these incidents in Q1 and this year it's dropped down to 35. Additionally, the change could also be attributable to the momentum growing in cryptomining activity. 

"We also think the shift toward cryptomining is possibly easing some of the attention on data theft," says Goddijn. This would reduce the number of publicly disclosed breaches but could represent a jump in malicious activity that's off the books, so to speak. "It's still too early to say for sure but it does go to show, malicious activity will follow the best opportunities for making a profit."

Regardless of shifts in attack trends, Goddijn says that all of the same old security fundamentals still apply to new threats. 

"Take cryptomining for example," she says. "Many of the same processes that are used to protect against ransomware - like good vulnerability management, restricting code execution, strong email filtering and helping users stay safe on line - are helpful for stopping mining malware too."

Organizations should also probably keep things in perspective. While the number of incidents is at a six-year low for early year activity, the only reason year-over-year number of breached records dropped is because there was such a huge spike in 2017. The 1.4 billion records exposed early this year is still more than double than the number of records exposed during Q1 of 2014, 2015 and 2016 combined.   

Interestingly, aside from the drop in W-2 phishing incidents, the mix of incident types and victim organization still remains largely static.

"The other metrics we track, such as breach types, who is being impacted, (and) size of breaches, are very similar to recent quarters," says Goddijn. "We have not observed sizable changes in the type of organizations being breached, the type of data that is being exposed, the number of large events, insider vs outsider activity, breach severity scores or where breaches are taking place. We would have expected other sizable shifts to be evident along with the drop in the number of breaches but that is not the case."

Related Content:

 

 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
5/9/2018 | 8:16:56 AM
PUBLIC DISCLOSED
OK - what about the ones we do not know about?  
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
6 Top Nontechnical Degrees for Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/21/2019
Anatomy of a BEC Scam
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3654
PUBLISHED: 2019-11-22
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be gener...
CVE-2014-2214
PUBLISHED: 2019-11-22
Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) error parameter to /includes/plugins/mobile/scripts/login.php or (2) id parameter to portal/openrssarticle.php
CVE-2014-6310
PUBLISHED: 2019-11-22
Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function.
CVE-2014-6311
PUBLISHED: 2019-11-22
generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges.
CVE-2019-16763
PUBLISHED: 2019-11-22
In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if ...