Feeds

Hackers, insiders blamed for US data breach growth

Taking a leak

SANS - Survey on application security programs

US organisations lost even more sensitive data in a greater number of information security screw-ups last year, according to a new survey.

A study by the Identity Theft Resource Center (ITRC) calculated that 35 million data records were exposed last year in 656 admitted incidents, up 47 per cent compared to the 446 data loss calamities logged in 2007. Since an estimated 40 per cent of breaches go unreported, the true number of exposed records is likely to be far higher than headline figure suggest, ITRC explains.

The vast majority of data breaches that were reported last year involved data unprotected by either encryption or even password protection. Only in 25 (2.4 per cent) of all breaches involved encrypted data, while password protection came into play in just 8.5 per cent of cases.

ITRC monitor press reports and statutory disclosures to monitor five categories of data loss: data lost in transit, accidental exposure, insider theft, subcontractors, and hacking.

Computer malware, hacking, and insider theft accounted for 29.6 per cent of recorded breaches, where the root cause of the attack is known. One in six breaches (15.7 per cent) were blamed to insider theft, a figure that's more then doubled between 2007 and 2008.

More encouragingly, data losses due to human error rather than malign action dropped in frequency while still accounting for more than a third of cases (35.2 per cent), again where the cause of a breach has been determined.

Meanwhile, electronic breaches (82.3 per cent) continue to outnumber paper breaches (17.7 per cent) by almost four to one, ITRC concludes. US government organisation were inflicted in fewer breaches last year while screw-ups in the private sector showed a corresponding rise.

A full breakdown of the incidents logged by ITRC, on which it bases its report, can be found here (PDF warning). ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.