The Identity Theft Resource Center has released their 2008 year end results showing an increase in reported data breaches to 656 breaches from the previous years 446. The 47% increase in reported breaches show the persistent issues that have affected the personal data of millions of people.
Accidental exposures and data on the move incidents, such as lost or stolen laptops, devices and storage media accounted for the largest portion (35%) of incidents and 70% of records, while hacks were responsible for a mere 91 (14%) and only accounted for 19% of the exposed records. There are two important pieces of information missing from the ITRC year end results that dilute the real picture of the information security issues plaguing our personal information.
The publicly reported statistics on breaches show only the uncut potential of an incident. For example, the potential risk to 1,000 credit card, SSN, or any PII on a lost or stolen laptop is the same as the potential on a 1,000 equivalent records exfiltrated during a hack. This is the exact data provided to the public and available through sites such as the ITRC, datalossdb, and databreaches.net. What is not evident from these disclosures is the true likelihood or realized fraud associated with these breaches. The chance of a stolen laptop ending up in the hands of someone who knows what data they have and has the knowledge or resources to use it is much less likely then when the data ends up in the hands of someone who has intentionally hacked into or released specific malware targeted towards these records.
The other reason why these statistics can not be taken completely at face value is the information is only based on reported breaches. A steady increase in laws requiring the disclosure of breaches have likely created an increase in the amount of disclosed breaches inflating the percentages of reported incidents over time. On the other hand, breaches only need to be disclosed if certain state and data type requirements are met , such as the data including names or SSN. Many breaches that involve data outside of state requirements or that only involve credit card numbers may not require disclosure. Of the incidents contained in the ITRC report, 42% did not include the number of records exposed. These two issues leave us with potentially inflated reports of increased breaches while at the same time only providing lower bounds of the actual number of breaches and records exposed for the year.
An area of real concern is the increase in insider attacks. We can only assume the current economic state may have contributed to this increase, but the number of reported incidents has rocketed more than two-fold to 15.7% from the previous year. Insiders tend to have access to large data sets of PII due to their job roles and even knowledge or administrative rights over controls in place to protect this data. This is a clear indicator to companies that limited access and dual controls are necessary to avoid these massive blunders.
The effort that has been taken by many individuals and company over recent years to aggregate and provide this information has truly been a blessing, providing to the public a once hidden abstract issue that has persisted with personal information scattered throughout organizations. We can only hope and push for future transparency in disclosures of personal information breaches as we continue into 2009.