By Ron Benvenisti. With an estimated number of worldwide Internet users hovering around three billion – one record was stolen for every three users and 76% of them affected the U.S. It’s no surprise that the main M.O for cyber crooks remains identity theft.
The 2014 Breach Level Index (2014: Year of Mega Breaches & Identity Theft) released by Gemalto highlights these alarming statistics. The scale of the problem appears to be significantly worse than first thought.
“[More] than 1,500 data breaches led to one billion data records compromised worldwide during 2014. These numbers represent a 49% increase in data breaches and a 78% increase in data records that were either stolen or lost compared to 2013.” And this is besides the staggering scale of 2014’s reported incidents where eBay lost 145 million records, Staples 1.6 million, Home Depot 109 million, JPMorgan Chase 83 million and the blockbuster Anthem breach which is estimated to have affected 18.8 million non-customers besides the 80 million records of current and former customers and employees across Amerigroup, Empire Blue Cross / Blue Shield, Caremore, and Unicare. These unprecedented breaches don’t count the seemingly countless other incidents, reported and not reported, all of which affected every day, average Americans’ personal information.
The report also found that:
- 76% of 2014’s incidents affected North America.
- 54% of data breaches were identity theft-based.
- The retail sector suffered 55% of the total number of breached records.
- 55% of incidents were the work of malicious outsiders. (45% the work or error of insiders)
- Only 4% of incidents involved encrypted data.
Of all the reported incidents in 2014, only 4% of them – that’s 58 out of 1450 reported in total – involved “data that was encrypted in part or in full”. What this means is that even though organizations are increasingly at risk of attack, where the sheer volume of data which is at risk is enormous, sensible and inexpensive precautions were pretty much ignored by the overwhelming majority (96%) of organizations. With the potential liabilities incurred, from legal repercussions, loss of customer trust, disruption and loss of business which could even mean bankruptcy, every business that collects, processes, or holds information is required to, and must take responsibility for it. As the study shows, simply encrypting data can prevent 96% of a company’s exposure. Let’s hope we have learned our lesson from 2014 and employ basic simple and inexpensive means which are proven to eliminate 96% of the risk.
As always, feel free to contact me at rbenvenistiATintegrissecurity.com, a proud partner of the New York/New Jersey Electronic Crimes Task Force. For free security tools and insights visit: https://www.integrissecurity.com/SecurityTools and http://integrissecurityinsights.blogspot.com/