Data breach: Difference between revisions
→Major incidents: Added 2011 Citigroup and 2008 Countrywide Financial data breaches |
Johndburger (talk | contribs) Reverted 1 edit by 8.3.127.178 (talk): Minor vandalism |
||
(604 intermediate revisions by more than 100 users not shown) | |||
Line 1: | Line 1: | ||
{{Short description|Intentional or unintentional release of secure information}} |
|||
A '''data breach''' is the intentional or unintentional release of [[secure information]] to an untrusted environment. Other terms for this phenomenon include '''unintentional information disclosure''', '''data leak''' and also '''data spill'''. Incidents range from concerted attack by [[black hat]]s with the backing of [[organized crime]] or [[Central government|national governments]] to careless disposal of used computer equipment or data storage media. |
|||
{{good article}} |
|||
Definition "A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so." |
|||
Data breaches may involve financial information such as credit card or bank details, personal health information (PHI), Personally identifiable information (PII), trade secrets of corporations or intellectual property. |
|||
A '''data breach''', also known as '''data leakage''', is "the unauthorized exposure, disclosure, or loss of [[personal information]]".{{sfn|Solove |Hartzog|2022|p=5}} |
|||
According to the [[nonprofit]] [[consumer organization]] [[Privacy Rights Clearinghouse]], a total of 227,052,199 individual records containing sensitive personal information were involved in security breaches in the United States between January 2005 and May 2008, excluding incidents where sensitive data was apparently not actually exposed.<ref name="pri"/> |
|||
Attackers have a variety of motives, from financial gain to [[hacktivism|political activism]], [[political repression]], and [[espionage]]. There are several technical root causes of data breaches, including accidental or intentional disclosure of information by insiders, loss or theft of [[encryption|unencrypted]] devices, hacking into a system by exploiting [[software vulnerabilities]], and [[social engineering attack]]s such as [[phishing]] where insiders are tricked into disclosing information. Although prevention efforts by the company holding the data can reduce the risk of data breach, it cannot bring it to zero. |
|||
The first reported breach was in 2002 and the number occurring each year has grown since then. A large number of data breaches are never detected. If a breach is made known to the company holding the data, post-breach efforts commonly include containing the breach, investigating its scope and cause, and notifications to people whose records were compromised, as required by law in many jurisdictions. Law enforcement agencies may investigate breaches, although the hackers responsible are rarely caught. |
|||
Many criminals sell data obtained in breaches on the [[dark web]]. Thus, people whose personal data was compromised are at elevated risk of [[identity theft]] for years afterwards and a significant number will become victims of this crime. [[Data breach notification laws]] in many jurisdictions, including all [[states of the United States]] and [[European Union member states]], require the notification of people whose data has been breached. Lawsuits against the company that was breached are common, although few victims receive money from them. There is little empirical evidence of economic harm to firms from breaches except the direct cost, although there is some evidence suggesting a temporary, short-term decline in [[share price|stock price]]. |
|||
==Definition== |
==Definition== |
||
A data breach is a violation of "organizational, regulatory, legislative or contractual" law or policy{{sfn|Fowler|2016|p=2}} that causes "the unauthorized exposure, disclosure, or loss of [[personal information]]".{{sfn|Solove |Hartzog|2022|p=5}} Legal and contractual definitions vary.{{sfn|Solove |Hartzog|2022|p=41}}{{sfn|Fowler|2016|p=2}} Some researchers include other types of information, for example [[intellectual property]] or [[classified information]].{{sfn|Shukla et al.|2022|pp=47–48}} However, companies mostly disclose breaches because it is required by law,{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=18}} and only personal information is covered by [[data breach notification laws]].{{sfn|Solove |Hartzog|2022|p=42}}{{sfn|Fowler|2016|p=45}} |
|||
This may include incidents such as theft or loss of [[digital media]] such as [[Magnetic tape data storage|computer tapes]], [[hard drive]]s, or [[laptop computer]]s containing such media upon which such information is stored [[encryption|unencrypted]], posting such information on the [[world wide web]] or on a computer otherwise accessible from the [[Internet]] without proper [[information security]] precautions, transfer of such information to a system which is not completely open but is not appropriately or formally [[accreditation|accredited]] for security at the approved level, such as unencrypted [[e-mail]], or transfer of such information to the [[information system]]s of a possibly hostile agency, such as a competing corporation or a foreign nation, where it may be exposed to more intensive decryption techniques.<ref>''[http://www.archives.gov/isoo/faqs/incidents-spills.html When we discuss incidents occurring on NSSs, are we using commonly defined terms?]'', "Frequently Asked Questions on Incidents and Spills", [[National Archives]] Information Security Oversight Office</ref> |
|||
==Prevalence== |
|||
==Trusted environment== |
|||
{{see also|List of data breaches}} |
|||
The notion of a trusted environment is somewhat fluid. The departure of a trusted staff member with access to sensitive information can become a data breach if the staff member retains access to the data subsequent to termination of the trust relationship. In distributed systems, this can also occur with a breakdown in a [[web of trust]]. |
|||
The first reported data breach occurred on 5 April 2002{{sfn|Joerling|2010|p=468 fn 7}} when 250,000 [[social security numbers]] collected by the [[State of California]] were stolen from a data center.{{sfn|Lesemann|2010|p=206}} Before the widespread adoption of [[data breach notification laws]] around 2005, the prevalence of data breaches is difficult to determine. Even afterwards, statistics per year cannot be relied on because data breaches may be reported years after they occurred,{{sfn|Solove |Hartzog|2022|p=18}} or not reported at all.{{sfn|Solove |Hartzog|2022|p=29}} Nevertheless, the statistics show a continued increase in the number and severity of data breaches that continues {{As of |2022|lc=yes}}.{{sfn|Solove |Hartzog|2022|pp=17–18}} In 2016, researcher [[Sasha Romanosky]]<!-- redlink, probably notable --> estimated that data breaches (excluding [[phishing]]) outnumbered other security breaches by a factor of four.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=9}} |
|||
== |
==Perpetrators== |
||
According to a 2020 estimate, 55 percent of data breaches were caused by [[organized crime]], 10 percent by [[system administrators]], 10 percent by [[end user]]s such as customers or employees, and 10 percent by states or state-affiliated actors.{{sfn|Crawley|2021|p=46}} Opportunistic criminals may cause data breaches—often using [[malware]] or [[social engineering attack]]s, but they will typically move on if the security is above average. More organized criminals have more resources and are more focused in their [[targeted threat|targeting of particular data]].{{sfn|Fowler|2016|pp=7–8}} Both of them sell the information they obtain for financial gain.{{sfn|Fowler|2016|p=13}} Another source of data breaches are [[hacktivism|politically motivated hackers]], for example [[Anonymous (hacker group)|Anonymous]], that target particular objectives.{{sfn|Fowler|2016|pp=9–10}} State-sponsored hackers target either citizens of their country or foreign entities, for such purposes as [[political repression]] and [[espionage]]. Often they use undisclosed [[Zero-day (computing)|zero-day vulnerabilities]] for which the hackers are paid large sums of money.{{sfn|Fowler|2016|pp=10–11}} The [[Pegasus spyware]]—a [[no-click malware]] developed by the Israeli company [[NSO Group]] that can be installed on most cellphones and spies on the users' activity—has drawn attention both for use against criminals such as drug kingpin [[El Chapo]] as well as political dissidents, facilitating the [[murder of Jamal Khashoggi]].{{sfn|Kaster|Ensign|2023|p=355}} |
|||
Most such incidents publicized in the media involve private information on individuals, ''i.e.'' [[social security number]]s, ''etc.''. Loss of corporate information such as [[trade secret]]s, sensitive corporate information, details of [[contract]]s, ''etc.'' or of government information is frequently unreported, as there is no compelling reason to do so in the absence of potential damage to private citizens, and the publicity around such an event may be more damaging than the loss of the data itself. |
|||
==Causes== |
|||
===Technical causes=== |
|||
Despite developers' goal of delivering a product that works entirely as intended, virtually all [[software bugs|software]] and [[hardware bug|hardware]] contains bugs.{{sfn|Ablon|Bogart|2017|p=1}} If a bug creates a security risk, it is called a [[vulnerability (computing)|vulnerability]].{{sfn|Ablon|Bogart|2017|p=2}}{{sfn|Daswani |Elbayadi|2021|p=25}}{{sfn|Seaman|2020|pp=47–48}} [[Software patch|Patches]] are often released to fix identified vulnerabilities, but those that remain unknown ([[Zero-day (computing)|zero day]]s) as well as those that have not been patched are still liable for exploitation.{{sfn|Daswani |Elbayadi|2021|pp=26–27}} Both software written by the target of the breach and third party software used by them are vulnerable to attack.{{sfn|Daswani |Elbayadi|2021|p=25}} The [[software vendor liability|software vendor is rarely legally liable]] for the cost of breaches, thus creating an incentive to make cheaper but less secure software.{{sfn|Sloan|Warner|2019|pp=104–105}} |
|||
Vulnerabilities vary in their ability to be [[Exploit (computer security)|exploit]]ed by malicious actors. The most valuable allow the attacker to [[code injection|inject]] and run their own code (called [[malware]]), without the user being aware of it.{{sfn|Ablon|Bogart|2017|p=2}} Some malware is downloaded by users via clicking on a malicious link, but it is also possible for malicious [[web applications]] to download malware just from visiting the website ([[drive-by download]]). [[Keyloggers]], a type of malware that records a user's keystrokes, are often used in data breaches.{{sfn|Daswani |Elbayadi|2021|p=19–22}} The majority of data breaches could have been averted by storing all sensitive information in an encrypted format. That way, physical possession of the storage device or access to encrypted information is useless unless the attacker has the [[encryption key]].{{sfn|Daswani |Elbayadi|2021|p=15}} [[Hash function|Hashing]] is also a good solution for keeping [[password]]s safe from [[brute-force attack]]s, but only if the algorithm is sufficiently secure.{{sfn|Ntantogian |Malliaros|Xenakis|2019}} |
|||
Many data breaches occur on the hardware operated by a partner of the organization targeted—including the [[2013 Target data breach]] and [[2014 JPMorgan Chase data breach]].{{sfn|Daswani |Elbayadi|2021|pp=22–23}} [[Outsourcing]] work to a third party leads to a risk of data breach if that company has lower security standards; in particular, small companies often lack the resources to take as many security precautions.{{sfn|Fowler|2016|pp=19–20}}{{sfn|Daswani |Elbayadi|2021|pp=22–23}} As a result, outsourcing agreements often include security guarantees and provisions for what happens in the event of a data breach.{{sfn|Fowler|2016|pp=19–20}} |
|||
===Human causes=== |
|||
Human causes of breach are often based on trust of another actor that turns out to be malicious. [[Social engineering attack]]s rely on tricking an insider into doing something that compromises the system's security, such as revealing a password or clicking a link to download malware.{{sfn|Sloan|Warner|2019|p=94}} Data breaches may also be deliberately caused by insiders.{{sfn|Makridis|2021|p=3}} One type of social engineering, [[phishing]],{{sfn|Sloan|Warner|2019|p=94}} obtains a user's [[credential]]s by sending them a malicious message impersonating a legitimate entity, such as a bank, and getting the user to enter their credentials onto a malicious website controlled by the cybercriminal. [[Two-factor authentication]] can prevent the malicious actor from using the credentials.{{sfn|Daswani |Elbayadi|2021|pp=16–19}} Training employees to recognize social engineering is another common strategy.{{sfn|Sloan|Warner|2019|pp=106–107}} |
|||
Another source of breaches is accidental disclosure of information, for example publishing information that should be kept private.{{sfn|Daswani |Elbayadi|2021|p=28}}{{sfn|Fowler|2016|p=19}} With the increase in [[remote work]] and [[bring your own device]] policies, large amounts of corporate data is stored on personal devices of employees. Via carelessness or disregard of company security policies, these devices can be lost or stolen.{{sfn|Fowler|2016|pp=18–19}} Technical solutions can prevent many causes of human error, such as encrypting all sensitive data, preventing employees from using insecure passwords, installing [[antivirus software]] to prevent malware, and implementing a robust patching system to ensure that all devices are kept up to date.{{sfn|Daswani |Elbayadi|2021|pp=31–32}} |
|||
==Breach lifecycle== |
|||
===Prevention=== |
|||
{{see also|Information security|Data loss prevention software}} |
|||
Although attention to security can reduce the risk of data breach, it cannot bring it to zero. Security is not the only priority of organizations, and an attempt to achieve perfect security would make the technology unusable.{{sfn|Solove |Hartzog|2022|pp=69–70}} Many companies hire a [[chief information security officer]] (CISO) to oversee the company's information security strategy.{{sfn|Daswani |Elbayadi|2021|pp=7, 9–10}} To obtain information about potential threats, security professionals will network with each other and share information with other organizations facing similar threats.{{sfn|Daswani |Elbayadi|2021|pp=200–201}} Defense measures can include an updated incident response strategy, contracts with [[digital forensics]] firms that could investigate a breach,{{sfn|Daswani |Elbayadi|2021|pp=203–204}} [[cyber insurance]],{{sfn|Daswani |Elbayadi|2021|p=205}}{{sfn|Fowler|2016|p=45}} and monitoring the [[dark web]] for stolen credentials of employees.{{sfn|Daswani |Elbayadi|2021|pp=206–207}} In 2024, the United States [[National Institute of Standards and Technology]] (NIST) issued a special publication, "Data Confidentiality: Identifying and Protecting Assets Against Data Breaches".{{sfn|Fisher ''et al.''|2024|loc=Title page}} The [[NIST Cybersecurity Framework]] also contains information about data protection.{{sfn|Fisher ''et al.''|2024|p=2}} Other organizations have released different standards for data protection.{{sfn|Fowler|2016|p=210}} |
|||
The architecture of a company's systems plays a key role in deterring attackers. Daswani and Elbayadi recommend having only one means of [[authentication]],{{sfn|Daswani |Elbayadi|2021|p=217}} avoiding redundant systems, and making the most secure setting default.{{sfn|Daswani |Elbayadi|2021|pp=215–216}} [[Defense in depth (computing)|Defense in depth]] and [[distributed privilege]] (requiring multiple authentications to execute an operation) also can make a system more difficult to hack.{{sfn |Tjoa ''et al.''|2024|p=14}} Giving employees and software the least amount of access necessary to fulfill their functions ([[principle of least privilege]]) limits the likelihood and damage of breaches.{{sfn|Daswani |Elbayadi|2021|p=217}}{{sfn|Lenhard|2022|p=53}} Several data breaches were enabled by reliance on [[security by obscurity]]; the victims had put access credentials in publicly accessible files.{{sfn|Daswani |Elbayadi|2021|p=218}} Nevertheless, prioritizing ease of use is also important because otherwise users might circumvent the security systems.{{sfn|Daswani |Elbayadi|2021|pp=218–219}} Rigorous [[software testing]], including [[penetration testing]], can reduce software vulnerabilities, and must be performed prior to each release even if the company is using a [[CI/CD|continuous integration/continuous deployment]] model where new versions are constantly being rolled out.{{sfn|Daswani |Elbayadi|2021|pp=314–315}} |
|||
The principle of [[least persistence]]{{sfn |Tjoa ''et al.''|2024|p=68}}—avoiding the collection of data that is not necessary and destruction of data that is no longer necessary—can mitigate the harm from breaches.{{sfn|Lenhard|2022|p=60}}{{sfn|Fowler|2016|p=184}}{{sfn|Solove |Hartzog|2022|p=146}} The challenge is that destroying data can be more complex with modern database systems.{{sfn |Tjoa ''et al.''|2024|p=69}} |
|||
===Response=== |
|||
{{see also|Computer emergency response team|label1=Computer security incident response team}} |
|||
A large number of data breaches are never detected.{{sfn|Crawley|2021|p=39}} Of those that are, most breaches are detected by third parties;{{sfn|Fowler|2016|p=64}}{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=25}} others are detected by employees or automated systems.{{sfn|Fowler|2016|p=4}} Responding to breaches is often the responsibility of a dedicated [[Computer emergency response team|computer security incident response team]], often including technical experts, [[public relations]], and legal counsel.{{sfn|Crawley|2021|p=97}}{{sfn|Fowler|2016|pp=5, 32}} Many companies do not have sufficient expertise in-house, and subcontract some of these roles;{{sfn|Fowler|2016|p=86}} often, these outside resources are provided by the cyber insurance policy.{{sfn|Fowler|2016|p=94}} After a data breach becomes known to the company, the next steps typically include confirming it occurred, notifying the response team, and attempting to contain the damage.{{sfn|Fowler|2016|pp=4–5}} |
|||
To stop exfiltration of data, common strategies include shutting down affected servers, taking them offline, [[software patch|patching]] the vulnerability, and [[Software build|rebuilding]].{{sfn|Fowler|2016|pp=120–122}} Once the exact way that the data was compromised is identified, there is typically only one or two technical vulnerabilities that need to be addressed in order to contain the breach and prevent it from reoccurring.{{sfn|Fowler|2016|p=115}} A [[penetration test]] can then verify that the fix is working as expected.{{sfn|Fowler|2016|p=116}} If [[malware]] is involved, the organization must investigate and close all infiltration and exfiltration vectors, as well as locate and remove all malware from its systems.{{sfn|Fowler|2016|pp=117–118}} If data was posted on the [[dark web]], companies may attempt to have it taken down.{{sfn|Fowler|2016|p=119}} Containing the breach can compromise investigation, and some tactics (such as shutting down servers) can violate the company's contractual obligations.{{sfn|Fowler|2016|p=124}} |
|||
Gathering data about the breach can facilitate later litigation or criminal prosecution,{{sfn|Fowler|2016|pp=81–82}} but only if the data is gathered according to legal standards and the [[chain of custody]] is maintained.{{sfn|Fowler|2016|p=83}} Database forensics can narrow down the records involved, limiting the scope of the incident.{{sfn|Fowler|2016|p=128}} Extensive investigation may be undertaken, which can be even more expensive than [[litigation]].{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=25}} In the United States, breaches may be investigated by government agencies such as the [[Office for Civil Rights]], the [[United States Department of Health and Human Services]], and the [[Federal Trade Commission]] (FTC).{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=22}} Law enforcement agencies may investigate breaches{{sfn|Fowler|2016|p=44}} although the hackers responsible are rarely caught.{{sfn|Solove |Hartzog|2022|p=58}} |
|||
Notifications are typically sent out as required by law.{{sfn|Fowler|2016|p=5, 44}} Many companies offer free [[credit monitoring]] to people affected by a data breach, although only around 5 percent of those eligible take advantage of the service.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=13}} Issuing new credit cards to consumers, although expensive, is an effective strategy to reduce the risk of [[credit card fraud]].{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=13}} Companies try to restore trust in their business operations and take steps to prevent a breach from reoccurring.{{sfn|Fowler|2016|pp=5–6}} |
|||
==Consequences== |
==Consequences== |
||
===For consumers=== |
|||
Although such incidents pose the risk of [[identity theft]] or other serious consequences, in most cases there is no lasting damage; either the breach in security is remedied before the information is accessed by unscrupulous people, or the thief is only interested in the hardware stolen, not the data it contains. Nevertheless, when such incidents become publicly known, it is customary for the offending party to attempt to mitigate [[damages]] by providing to the victims subscription to a [[credit reporting agency]], for instance. |
|||
After a data breach, criminals make money by selling data, such as usernames, passwords, [[social media]] or [[loyalty business model|customer loyalty]] account information, [[debit card|debit]] and [[credit card]] numbers,{{sfn|Fowler|2016|p=13}} and personal health information (see [[medical data breach]]).{{sfn|Fowler|2016|p=14}} Criminals often sell this data on the [[dark web]]—parts of the internet where it is difficult to trace users and illicit activity is widespread—using platforms like [[.onion]] or [[I2P]].{{sfn|Fowler|2016|pp=12–13}} Originating in the 2000s, the dark web, followed by untraceable [[cryptocurrencies]] such as [[Bitcoin]] in the 2010s, made it possible for criminals to sell data obtained in breaches with minimal risk of getting caught, facilitating an increase in hacking.{{sfn|Davidoff|2019|loc="Modern dark data brokers"}}{{sfn|Solove |Hartzog|2022|p=21}} One popular darknet marketplace, [[Silk Road (marketplace)|Silk Road]], was shut down in 2013 and its operators arrested, but several other marketplaces emerged in its place.<ref>{{cite news |last1=Howell |first1=Christian Jordan |last2=Maimon |first2=David |title=Darknet markets generate millions in revenue selling stolen personal data, supply chain study finds |url=https://theconversation.com/darknet-markets-generate-millions-in-revenue-selling-stolen-personal-data-supply-chain-study-finds-193506 |access-date=22 April 2024 |work=[[The Conversation (website)|The Conversation]] |date=2 December 2022}}</ref> [[Telegram (software)|Telegram]] is also a popular forum for illegal sales of data.<ref>{{cite journal | url=https://link.springer.com/article/10.1007/s12117-024-09532-6 | doi=10.1007/s12117-024-09532-6 | title=Stolen data markets on Telegram: A crime script analysis and situational crime prevention measures | date=2024 | last1=Garkava | first1=Taisiia | last2=Moneva | first2=Asier | last3=Leukfeldt | first3=E. Rutger | journal=Trends in Organized Crime }}</ref> |
|||
This information may be used for a variety of purposes, such as [[spamming]], obtaining products with a victim's loyalty or payment information, [[identity theft]], [[drug fraud|prescription drug fraud]], or [[insurance fraud]].{{sfn|Fowler|2016|pp=13–14}} The threat of data breach or revealing information obtained in a data breach can be used for [[extortion]].{{sfn|Fowler|2016|p=13}} |
|||
==Major incidents== |
|||
Well known incidents include: |
|||
Consumers may suffer various forms of tangible or intangible harm from the theft of their personal data, or not notice any harm.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=27}} A significant portion of those affected by a data breach become victims of [[identity theft]].{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=13}} A person's identifying information often circulates on the dark web for years, causing an increased risk of identity theft regardless of remediation efforts.{{sfn|Solove |Hartzog|2022|p=58}}{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|pp=30–31}} Even if a customer does not end up footing the bill for [[credit card fraud]] or identity theft, they have to spend time resolving the situation.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=29}}{{sfn|Solove |Hartzog|2022|p=56}} Intangible harms include [[doxxing]] (publicly revealing someone's personal information), for example medication usage or personal photos.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|pp=27–29}} |
|||
===2011=== |
|||
*In April 2011, [[Sony]] experienced a data breach within their [[Playstation Network]]. It is estimated that the information of 100 million users was compromised. |
|||
*In June 2011, [[Citigroup]] disclosed a data breach within their credit card operation, affecting approximately 210,000 or 1% of their customers' accounts.<ref>[http://www.forbes.com/sites/andygreenberg/2011/06/09/citibank-reveals-one-percent-of-all-accounts-exposed-in-hack/]</ref><ref>[http://lessriskybiz.blogspot.com/2011/06/convergence-of-data-identity-and.html]]</ref> |
|||
=== |
===For organizations=== |
||
There is little empirical evidence of economic harm from breaches except the direct cost, although there is some evidence suggesting a temporary, short-term decline in [[share price|stock price]].{{sfn|Makridis|2021|p=1}} Other impacts on the company can range from lost business, reduced employee productivity due to systems being offline or personnel redirected to working on the breach,{{sfn|Fowler|2016|p=22}} resignation or firing of senior executives,{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=22}} [[reputational damage]],{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=22}}{{sfn|Fowler|2016|p=41}} and increasing the future cost of auditing or security.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=22}} Consumer losses from a breach are usually a negative [[externality]] for the business.{{sfn|Sloan|Warner|2019|p=104}} Some experts have argued that the evidence suggests there is not enough direct costs or reputational damage from data breaches to sufficiently [[incentive|incentivize]] their prevention.{{sfn|Makridis|2021|pp=1, 7}}{{sfn|Sloan|Warner|2019|p=64}} |
|||
* In December 2009 a [[RockYou!]] password database was breached containing 32 million user names and plaintext passwords, further compromising the use of weak passwords for any purpose. |
|||
* In January 2009 [[Heartland Payment Systems]] announced that it had been "the victim of a security breach within its processing system", possibly part of a "global cyber fraud operation".<ref>[http://www.2008breach.com/Information20090120.asp Heartland Payment Systems Uncovers Malicious Software In Its Processing System ]</ref> The intrusion has been called the largest criminal breach of card data ever, with estimates of up to 100 million cards from more than 650 financial services companies compromised.<ref>[http://www.businessweek.com/technology/content/jul2009/tc2009076_891369.htm Lessons from the Data Breach at Heartland], ''[[MSNBC]]'', July 7, 2009</ref> |
|||
Estimating the cost of data breaches is difficult, both because not all breaches are reported and also because calculating the impact of breaches in financial terms is not straightforward. There are multiple ways of calculating the cost to businesses, especially when it comes to personnel time dedicated to dealing with the breach.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|pp=8–10}} Author Kevvie Fowler estimates that more than half the direct cost incurred by companies is in the form of litigation expenses and services provided to affected individuals, with the remaining cost split between notification and detection, including forensics and investigation. He argues that these costs are reduced if the organization has invested in security prior to the breach or has previous experience with breaches. The more [[Record (computer science)|data record]]s involved, the more expensive a breach typically will be.{{sfn|Fowler|2016|p=21}} In 2016, researcher [[Sasha Romanosky]]<!-- redlink, probably notable --> estimated that while the mean breach cost around the targeted firm $5 million, this figure was inflated by a few highly expensive breaches, and the typical data breach was much less costly, around $200,000. Romanosky estimated the total annual cost to corporations in the United States to be around $10 billion.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=10}} |
|||
===2008=== |
|||
* In January 2008, [[GE Money]], a division of [[General Electric]], disclosed that a magnetic tape containing 150,000 [[social security number]]s and in-store [[credit card]] information from 650,000 retail customers is known to be missing from an [[Iron Mountain Incorporated]] storage facility. [[J.C. Penney]] is among 230 retailers affected.<ref>[http://www.informationweek.com/news/showArticle.jhtml?articleID=205901244 GE Money Backup Tape With 650,000 Records Missing At Iron Mountain - Iron Mountain<!-- Bot generated title -->]</ref> |
|||
*[[Horizon Blue Cross and Blue Shield of New Jersey]], January, 300,000 members <ref name="pri"/> |
|||
*[[Lifeblood (blood bank)|Lifeblood]], February, 321,000 [[blood donor]]s <ref name="pri"/> |
|||
*[[Matthew Single|British National Party]] membership list leak,<ref>[http://news.bbc.co.uk/1/hi/uk/7736405.stm BNP activists' details published - BBC News]</ref> |
|||
*In June 2008, [[Countrywide Financial]] (since acquired by [[Bank of America]]) allegedly fell victim to a data breach when, according to news reports and court documents, employee Rene L. Rebollo Jr. stole and sold up to 2.5 million customers' personal information including social security numbers.<ref>[http://articles.latimes.com/2010/aug/24/business/la-fi-countrywide-20100824]</ref><ref>[http://www.bankinfosecurity.com/articles.php?art_id=2398]</ref> In July 2010, [[Bank of America]] settled more than 30 related class-action lawsuits by offering free credit monitoring, identity theft insurance and reimbursement for losses to as many as 17 million consumers impacted by the alleged data breach. The settlement was estimated at $56.5 million not including court costs.<ref>[http://lessriskybiz.blogspot.com/2011/06/convergence-of-data-identity-and.html]</ref> |
|||
== |
==Laws== |
||
===Notification=== |
|||
*[[Jared Ilovar|The 2007 loss of Ohio and Connecticut state data by Accenture]] |
|||
{{main|Data breach notification laws}} |
|||
*[[T.J. Maxx#Data theft|TJ Maxx]], data for 45 million credit and debit accounts<ref>{{cite web |url=http://www.msnbc.msn.com/id/17853440/ |title=T.J. Maxx data theft worse than first reported |accessdate=2009-02-16 |work= |publisher=[[msnbc.com]] |date=2007-03-29 }}</ref> |
|||
The law regarding data breaches is often found in [[privacy law|legislation to protect privacy]] more generally, and is dominated by provisions mandating notification when breaches occur.{{sfn|Solove |Hartzog|2022|p=10}} Laws differ greatly in how breaches are defined,{{sfn|Solove |Hartzog|2022|p=41}} what type of information is protected, the deadline for notification,{{sfn|Solove |Hartzog|2022|p=42}} and who has [[standing (law)|standing]] to sue if the law is violated.{{sfn|Solove |Hartzog|2022|p=43}} Notification laws increase [[Transparency (behavior)|transparency]] and provide a reputational incentive for companies to reduce breaches.{{sfn|Solove |Hartzog|2022|p=44}} The cost of notifying the breach can be high if many people were affected and is incurred regardless of the company's responsibility, so it can function like a [[strict liability]] fine.{{sfn|Solove |Hartzog|2022|p=45}} |
|||
{{as of|2024}}, ''Thomas on Data Breach'' listed 62 [[United Nations member states]] that are covered by data breach notification laws.<!-- 8 in Americas + US, 5 in European + 27 EU, 14 Asia, 7 Africa --> Some other countries require breach notification in more general [[Information privacy law|data protection law]]s.{{sfn|Thomas|2023|pp=xxvii, xxix, xxxii-xxxiii, xxxiv}} Shortly after the first reported data breach in April 2002, California passed [[California Senate Bill 1386 (2002)|a law requiring notification]] when an individual's personal information was breached.{{sfn|Lesemann|2010|p=206}} In the United States, notification laws proliferated after the February 2005 [[ChoicePoint data breach]], widely publicized in part because of the large number of people affected (more than 140,000) and also because of outrage that the company initially informed only affected people in California.{{sfn|Lesemann|2010|pp=206–207}}{{sfn|Joerling|2010|pp=468–469}} In 2018, the [[European Union]]'s [[General Data Protection Regulation]] (GDPR) took effect. The GDPR requires notification within 72 hours, with very high fines possible for large companies not in compliance. This regulation also stimulated the tightening of data privacy laws elsewhere.{{sfn|Seaman|2020|pp=6–7}}{{sfn|Solove |Hartzog|2022|p=40}} {{as of|2022}}, the only [[United States federal law]] requiring notification for data breaches is limited to medical data regulated under [[HIPAA]], but all 50 states (since Alabama passed a law in 2018) have their own general data breach notification laws.{{sfn|Solove |Hartzog|2022|p=40}} |
|||
*[[2007 UK child benefit data scandal]] |
|||
*[[CGI Group]], August, 283,000 retirees from [[New York City]] <ref name="pri"/> |
|||
*[[Gap (clothing retailer)|The Gap]], September, 800,000 job applicants <ref name="pri"/> |
|||
*[[Memorial Blood Center]], December, 268,000 [[blood donor]]s <ref name="pri"/> |
|||
*[[Davidson County Election Commission]], December, 337,000 voters <ref name="pri"/> |
|||
=== |
===Security safeguards=== |
||
Measures to protect data from a breach are typically absent from the law or vague.{{sfn|Solove |Hartzog|2022|p=10}} Filling this gap is standards required by [[cyber insurance]], which is held by most large companies and [[insurance as regulation|functions as ''de facto'' regulation]].{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=24}}{{sfn|Talesh|2018|p=237}} Of the laws that do exist, there are two main approaches—one that prescribes specific standards to follow, and the [[reasonableness]] approach.{{sfn|Solove |Hartzog|2022|p=48}} The former is rarely used due to a lack of flexibility and reluctance of legislators to arbitrate technical issues; with the latter approach, the law is vague but specific standards can emerge from [[case law]].{{sfn|Solove |Hartzog|2022|pp=48–49}} Companies often prefer the standards approach for providing greater [[legal certainty]], but they might check all the boxes without providing a secure product.{{sfn|Solove |Hartzog|2022|p=52}} An additional flaw is that the laws are poorly enforced, with penalties often much less than the cost of a breach, and many companies do not follow them.{{sfn|Solove |Hartzog|2022|p=53}} |
|||
*[[AOL search data scandal]] (sometimes referred to as a "Data ''[[Exxon Valdez oil spill|Valdez]]''",<ref>''[http://www.doubletongued.org/index.php/dictionary/data_valdez/ data Valdez]'' [[Doubletongued dictionary]]</ref><ref>''[http://www.eff.org/Privacy/AOL/ AOL's Massive Data Leak]'', [[Electronic Frontier Foundation]]</ref><ref>''[http://www.netlingo.com/lookup.cfm?term=data%20Valdez data Valdez]'', [[Net Lingo]]</ref> due to its size) |
|||
*[[United States Department of Veterans Affairs|Department of Veterans Affairs]], May, 28,600,000 veterans, reserves, and active duty military personnel,<ref name="pri"/><ref>"[http://www.networkworld.com/news/2006/060606-active-duty-troop-information-part-of.html?nwwpkg=slideshows Active-duty troop information part of stolen VA data]", ''[[Network World]]'', June 6, 2006</ref> |
|||
*[[Ernst & Young]], May, 234,000 customers of [[Hotels.com]] (after a similar loss of data on 38,000 employees of Ernst & Young clients in February) <ref name="pri"/> |
|||
*[[Boeing]], December, 382,000 employees (after similar losses of data on 3,600 employees in April and 161,000 employees in November, 2005) <ref name="pri"/> |
|||
=== |
===Litigation=== |
||
Many [[class-action lawsuit]]s, [[derivative suit]]s, and other litigation have been brought after data breaches.{{sfn|Fowler|2016|p=5}} They are often [[Settlement (litigation)|settled]] regardless of the merits of the case due to the high cost of litigation.{{sfn|Fowler|2016|p=222}}{{sfn|Solove |Hartzog|2022|pp=55, 59}} Even if a settlement is paid, few affected consumers receive any money as it usually is only cents to a few dollars per victim.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=22}}{{sfn|Solove |Hartzog|2022|pp=55, 59}} Legal scholars [[Daniel J. Solove]] and [[Woodrow Hartzog]]<!-- redlink, notable --> argue that "Litigation has increased the costs of data breaches but has accomplished little else."{{sfn|Solove |Hartzog|2022|p=55}} Plaintiffs often struggle to prove that they suffered harm from a data breach.{{sfn|Solove |Hartzog|2022|p=55}} The contribution of a company's actions to a data breach varies,{{sfn|Solove |Hartzog|2022|p=53}}{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=23}} and likewise the liability for the damage resulting for data breaches is a contested matter. It is disputed what standard should be applied, whether it is strict liability, [[negligence]], or something else.{{sfn|National Academies of Sciences, Engineering, and Medicine|2016|p=23}} |
|||
*[[Ameriprise Financial]], stolen [[laptop]], December 24, 260,000 customer records <ref name="pri"> "[http://www.privacyrights.org/ar/ChronDataBreaches.htm A Chronology of Data Breaches]", [[Privacy Rights Clearinghouse]]</ref> |
|||
==See also== |
|||
* [[Full disclosure (computer security)]] |
|||
* [[Medical data breach]] |
|||
* [[Surveillance capitalism]] |
|||
* [[Data breaches in India]] |
|||
==References== |
==References== |
||
{{reflist}} |
{{reflist|32em}} |
||
== |
==Sources== |
||
{{refbegin|indent=yes}} |
|||
* "[http://www.teamshatter.com/breaches/ Most Recent Data Breaches]", [[TeamSHATTER]], updated regularly |
|||
*{{cite book |last1=Ablon |first1=Lillian |last2=Bogart |first2=Andy |title=Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits |date=2017 |publisher=Rand Corporation |isbn=978-0-8330-9761-3 |language=en|url=https://www.rand.org/content/dam/rand/pubs/research_reports/RR1700/RR1751/RAND_RR1751.pdf}} |
|||
* "[http://www.privacyrights.org/ar/ChronDataBreaches.htm A Chronology of Data Breaches]", [[Privacy Rights Clearinghouse]], updated twice a week |
|||
*{{cite book |last1=Crawley |first1=Kim |title=8 Steps to Better Security: A Simple Cyber Resilience Guide for Business |date=2021 |publisher=John Wiley & Sons |isbn=978-1-119-81124-4 |language=en|url=https://books.google.com/books?id=51U-EAAAQBAJ}} |
|||
* "[http://www.idtheftcenter.org/artman2/publish/lib_survey/ITRC_2008_Breach_List.shtml Identity Theft Resource Center - Data Breaches]", Updated weekly with statistical analyses |
|||
*{{cite book |last1=Daswani |first1=Neil|authorlink=Neil Daswani |last2=Elbayadi |first2=Moudy |title=Big Breaches: Cybersecurity Lessons for Everyone |date=2021 |publisher=Apress |isbn=978-1-4842-6654-0 |language=en|url=https://books.google.com/books?id=HtkHzgEACAAJ}} |
|||
* "[http://datalossdb.org/ Data Loss Database] [[Open Security Foundation]]'s research project documenting data loss incidents worldwide. |
|||
*{{cite book |last1=Davidoff |first1=Sherri |title=Data Breaches: Crisis and Opportunity |date=2019 |publisher=Addison-Wesley Professional |isbn=978-0-13-450772-9 |language=en}} |
|||
* "[http://www.databreaches.net/ Office of Inadequate Security]", Breach incidents reported in the media and from primary sources, worldwide. |
|||
*{{cite report |last1=Fisher |first1=William |last2=Craft |first2=R. Eugene |last3=Ekstrom |first3=Michael |last4=Sexton |first4=Julian |last5=Sweetnam |first5=John |title=Data Confidentiality: Identifying and Protecting Assets Against Data Breaches |date=2024 |url=https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1800-28.pdf |series=NIST Special Publications |publisher=[[National Institute of Standards and Technology]]|ref={{sfnref|Fisher et al.|2024}}}} |
|||
* "[http://www.phiprivacy.net/ Personal Health Information Privacy]", Breach incidents from the health care sector, worldwide. |
|||
*{{cite book |last1=Fowler |first1=Kevvie |title=Data Breach Preparation and Response: Breaches are Certain, Impact is Not |date=2016 |publisher=Elsevier Science |isbn=978-0-12-803451-4 |language=en|url=https://books.google.com/books?id=m5SZBgAAQBAJ}} |
|||
* "[http://doj.nh.gov/consumer/breaches.html Notices of Security Breaches]", [[New Hampshire]] Department of Justice |
|||
*{{cite journal |last1=Joerling |first1=Jill |title=Data Breach Notification Laws: An Argument for a Comprehensive Federal Law to Protect Consumer Data |journal=Washington University Journal of Law and Policy |date=2010 |volume=32 |pages=467 |url=https://heinonline.org/HOL/LandingPage?handle=hein.journals/wajlp32&div=16&id=&page=}} |
|||
* "[http://www.oag.state.md.us/idtheft/breacheNotices.htm Maryland Notice of Information Security Breaches]", [[Maryland]] Attorney General's Office |
|||
*{{cite journal |last1=Kaster |first1=Sean D. |last2=Ensign |first2=Prescott C. |title=Privatized espionage: NSO Group Technologies and its Pegasus spyware |journal=Thunderbird International Business Review |date=2023 |volume=65 |issue=3 |pages=355–364 |doi=10.1002/tie.22321|doi-access=free }} |
|||
* "[http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/breachtool.html Breaches Affecting 500 or More Individuals]", Breaches reported to the [[United States Department of Health and Human Services]] by HIPAA-covered ([[Health Insurance Portability and Accountability Act]]) entities. |
|||
*{{cite book |last1=Lenhard |first1=Thomas H. |title=Data Security: Technical and Organizational Protection Measures against Data Loss and Computer Crime |date=2022 |publisher=Springer Nature |isbn=978-3-658-35494-7 |language=en}} |
|||
* "[http://www.infothatmatter.org/ Information That Matter]", A data breach [[responsible disclosure]] project associated with [[OWASP]] [[Singapore]]. |
|||
*{{cite journal |last1=Lesemann |first1=Dana J. |title=One More unto the Breach: An Analysis of Legal, Technological, and Policy Issues Involving Data Breach Notification Statutes |journal=Akron Intellectual Property Journal |date=2010 |volume=4 |pages=203 |url=https://heinonline.org/HOL/LandingPage?handle=hein.journals/akrintel4&div=12&id=&page=}} |
|||
* "[http://www.breachblog.com/ The Breach Blog]", Data breach commentary and analysis. |
|||
*{{cite journal |last1=Makridis |first1=Christos A |title=Do data breaches damage reputation? Evidence from 45 companies between 2002 and 2018 |journal=Journal of Cybersecurity |date=2021 |volume=7 |issue=1 |doi=10.1093/cybsec/tyab021|doi-access=free }} |
|||
* "[http://breach.scmagazineblogs.com/ SC Magazine Data Breach Blog]", The [[SC Magazine]] Data Breach Blog. |
|||
*{{cite book |author1=[[National Academies of Sciences, Engineering, and Medicine]] |title=Data Breach Aftermath and Recovery for Individuals and Institutions: Proceedings of a Workshop |date=2016 |publisher=National Academies Press |isbn=978-0-309-44505-4 |language=en |chapter=Forum on Cyber Resilience Workshop Series|url=https://nap.nationalacademies.org/catalog/23559/data-breach-aftermath-and-recovery-for-individuals-and-institutions-proceedings}} |
|||
*{{cite journal |last1=Ntantogian |first1=Christoforos |last2=Malliaros |first2=Stefanos |last3=Xenakis |first3=Christos |title=Evaluation of password hashing schemes in open source web platforms |journal=Computers & Security |date=2019 |volume=84 |pages=206–224 |doi=10.1016/j.cose.2019.03.011|url=https://zenodo.org/record/2632724 }} |
|||
[[Category:Data security]] |
|||
*{{cite book |last1=Seaman |first1=Jim |title=PCI DSS: An Integrated Data Security Standard Guide |date=2020 |publisher=Apress |isbn=978-1-4842-5808-8 |language=en}} |
|||
[[Category:Computer security]] |
|||
*{{cite book |last1=Shukla |first1=Samiksha |last2=George |first2=Jossy P. |last3=Tiwari |first3=Kapil |last4=Kureethara |first4=Joseph Varghese |title=Data Ethics and Challenges |date=2022 |publisher=Springer Nature |isbn=978-981-19-0752-4 |language=en|ref={{sfnref|Shukla et al.|2022}}}} |
|||
[[Category:Secure communication]] |
|||
*{{cite book |last1=Sloan |first1=Robert H. |last2=Warner |first2=Richard |title=Why Don't We Defend Better?: Data Breaches, Risk Management, and Public Policy |date=2019 |publisher=CRC Press |isbn=978-1-351-12729-5 |language=en}} |
|||
[[Category:Computer network security]] |
|||
*{{cite book |last1=Solove |first1=Daniel J.|authorlink=Daniel J. Solove |last2=Hartzog |first2=Woodrow |title=Breached!: Why Data Security Law Fails and How to Improve it |date=2022 |publisher=Oxford University Press |isbn=978-0-19-094057-7 |language=en|url=https://books.google.com/books?id=EenMzQEACAAJ}} |
|||
[[Category:Computer security exploits]] |
|||
*{{cite journal |last1=Talesh |first1=Shauhin A. |title=Data Breach, Privacy, and Cyber Insurance: How Insurance Companies Act as "Compliance Managers" for Businesses |journal=Law & Social Inquiry |date=2018 |volume=43 |issue=2 |pages=417–440 |doi=10.1111/lsi.12303}} |
|||
*{{cite book |last1=Thomas |first1=Liisa M. |title=Thomas on Data Breach: A Practical Guide to Handling Data Breach Notifications Worldwide |date=2023 |publisher=[[Thomson Reuters]] |isbn=978-1-7319-5405-3 |language=en|url=https://static.legalsolutions.thomsonreuters.com/product_files/relateddocs/243610_20248_1038.pdf}} |
|||
*{{cite book |last1=Tjoa |first1=Simon |last2=Gafić |first2=Melisa |last3=Kieseberg |first3=Peter |title=Cyber Resilience Fundamentals |date=2024 |publisher=Springer Nature |isbn=978-3-031-52064-8 |language=en|ref={{sfnref|Tjoa et al.|2024}}}} |
|||
{{refend}} |
|||
{{Information security}} |
|||
[[de:Datenpanne]] |
|||
[[Category:Data breaches| ]] |
|||
[[Category:Data security|Breach]] |
|||
[[Category:Data laws]] |
|||
[[Category:Secure communication]] |
|||
[[Category:Security breaches]] |
Latest revision as of 13:32, 23 December 2024
A data breach, also known as data leakage, is "the unauthorized exposure, disclosure, or loss of personal information".[1]
Attackers have a variety of motives, from financial gain to political activism, political repression, and espionage. There are several technical root causes of data breaches, including accidental or intentional disclosure of information by insiders, loss or theft of unencrypted devices, hacking into a system by exploiting software vulnerabilities, and social engineering attacks such as phishing where insiders are tricked into disclosing information. Although prevention efforts by the company holding the data can reduce the risk of data breach, it cannot bring it to zero.
The first reported breach was in 2002 and the number occurring each year has grown since then. A large number of data breaches are never detected. If a breach is made known to the company holding the data, post-breach efforts commonly include containing the breach, investigating its scope and cause, and notifications to people whose records were compromised, as required by law in many jurisdictions. Law enforcement agencies may investigate breaches, although the hackers responsible are rarely caught.
Many criminals sell data obtained in breaches on the dark web. Thus, people whose personal data was compromised are at elevated risk of identity theft for years afterwards and a significant number will become victims of this crime. Data breach notification laws in many jurisdictions, including all states of the United States and European Union member states, require the notification of people whose data has been breached. Lawsuits against the company that was breached are common, although few victims receive money from them. There is little empirical evidence of economic harm to firms from breaches except the direct cost, although there is some evidence suggesting a temporary, short-term decline in stock price.
Definition
[edit]A data breach is a violation of "organizational, regulatory, legislative or contractual" law or policy[2] that causes "the unauthorized exposure, disclosure, or loss of personal information".[1] Legal and contractual definitions vary.[3][2] Some researchers include other types of information, for example intellectual property or classified information.[4] However, companies mostly disclose breaches because it is required by law,[5] and only personal information is covered by data breach notification laws.[6][7]
Prevalence
[edit]The first reported data breach occurred on 5 April 2002[8] when 250,000 social security numbers collected by the State of California were stolen from a data center.[9] Before the widespread adoption of data breach notification laws around 2005, the prevalence of data breaches is difficult to determine. Even afterwards, statistics per year cannot be relied on because data breaches may be reported years after they occurred,[10] or not reported at all.[11] Nevertheless, the statistics show a continued increase in the number and severity of data breaches that continues as of 2022[update].[12] In 2016, researcher Sasha Romanosky estimated that data breaches (excluding phishing) outnumbered other security breaches by a factor of four.[13]
Perpetrators
[edit]According to a 2020 estimate, 55 percent of data breaches were caused by organized crime, 10 percent by system administrators, 10 percent by end users such as customers or employees, and 10 percent by states or state-affiliated actors.[14] Opportunistic criminals may cause data breaches—often using malware or social engineering attacks, but they will typically move on if the security is above average. More organized criminals have more resources and are more focused in their targeting of particular data.[15] Both of them sell the information they obtain for financial gain.[16] Another source of data breaches are politically motivated hackers, for example Anonymous, that target particular objectives.[17] State-sponsored hackers target either citizens of their country or foreign entities, for such purposes as political repression and espionage. Often they use undisclosed zero-day vulnerabilities for which the hackers are paid large sums of money.[18] The Pegasus spyware—a no-click malware developed by the Israeli company NSO Group that can be installed on most cellphones and spies on the users' activity—has drawn attention both for use against criminals such as drug kingpin El Chapo as well as political dissidents, facilitating the murder of Jamal Khashoggi.[19]
Causes
[edit]Technical causes
[edit]Despite developers' goal of delivering a product that works entirely as intended, virtually all software and hardware contains bugs.[20] If a bug creates a security risk, it is called a vulnerability.[21][22][23] Patches are often released to fix identified vulnerabilities, but those that remain unknown (zero days) as well as those that have not been patched are still liable for exploitation.[24] Both software written by the target of the breach and third party software used by them are vulnerable to attack.[22] The software vendor is rarely legally liable for the cost of breaches, thus creating an incentive to make cheaper but less secure software.[25]
Vulnerabilities vary in their ability to be exploited by malicious actors. The most valuable allow the attacker to inject and run their own code (called malware), without the user being aware of it.[21] Some malware is downloaded by users via clicking on a malicious link, but it is also possible for malicious web applications to download malware just from visiting the website (drive-by download). Keyloggers, a type of malware that records a user's keystrokes, are often used in data breaches.[26] The majority of data breaches could have been averted by storing all sensitive information in an encrypted format. That way, physical possession of the storage device or access to encrypted information is useless unless the attacker has the encryption key.[27] Hashing is also a good solution for keeping passwords safe from brute-force attacks, but only if the algorithm is sufficiently secure.[28]
Many data breaches occur on the hardware operated by a partner of the organization targeted—including the 2013 Target data breach and 2014 JPMorgan Chase data breach.[29] Outsourcing work to a third party leads to a risk of data breach if that company has lower security standards; in particular, small companies often lack the resources to take as many security precautions.[30][29] As a result, outsourcing agreements often include security guarantees and provisions for what happens in the event of a data breach.[30]
Human causes
[edit]Human causes of breach are often based on trust of another actor that turns out to be malicious. Social engineering attacks rely on tricking an insider into doing something that compromises the system's security, such as revealing a password or clicking a link to download malware.[31] Data breaches may also be deliberately caused by insiders.[32] One type of social engineering, phishing,[31] obtains a user's credentials by sending them a malicious message impersonating a legitimate entity, such as a bank, and getting the user to enter their credentials onto a malicious website controlled by the cybercriminal. Two-factor authentication can prevent the malicious actor from using the credentials.[33] Training employees to recognize social engineering is another common strategy.[34]
Another source of breaches is accidental disclosure of information, for example publishing information that should be kept private.[35][36] With the increase in remote work and bring your own device policies, large amounts of corporate data is stored on personal devices of employees. Via carelessness or disregard of company security policies, these devices can be lost or stolen.[37] Technical solutions can prevent many causes of human error, such as encrypting all sensitive data, preventing employees from using insecure passwords, installing antivirus software to prevent malware, and implementing a robust patching system to ensure that all devices are kept up to date.[38]
Breach lifecycle
[edit]Prevention
[edit]Although attention to security can reduce the risk of data breach, it cannot bring it to zero. Security is not the only priority of organizations, and an attempt to achieve perfect security would make the technology unusable.[39] Many companies hire a chief information security officer (CISO) to oversee the company's information security strategy.[40] To obtain information about potential threats, security professionals will network with each other and share information with other organizations facing similar threats.[41] Defense measures can include an updated incident response strategy, contracts with digital forensics firms that could investigate a breach,[42] cyber insurance,[43][7] and monitoring the dark web for stolen credentials of employees.[44] In 2024, the United States National Institute of Standards and Technology (NIST) issued a special publication, "Data Confidentiality: Identifying and Protecting Assets Against Data Breaches".[45] The NIST Cybersecurity Framework also contains information about data protection.[46] Other organizations have released different standards for data protection.[47]
The architecture of a company's systems plays a key role in deterring attackers. Daswani and Elbayadi recommend having only one means of authentication,[48] avoiding redundant systems, and making the most secure setting default.[49] Defense in depth and distributed privilege (requiring multiple authentications to execute an operation) also can make a system more difficult to hack.[50] Giving employees and software the least amount of access necessary to fulfill their functions (principle of least privilege) limits the likelihood and damage of breaches.[48][51] Several data breaches were enabled by reliance on security by obscurity; the victims had put access credentials in publicly accessible files.[52] Nevertheless, prioritizing ease of use is also important because otherwise users might circumvent the security systems.[53] Rigorous software testing, including penetration testing, can reduce software vulnerabilities, and must be performed prior to each release even if the company is using a continuous integration/continuous deployment model where new versions are constantly being rolled out.[54]
The principle of least persistence[55]—avoiding the collection of data that is not necessary and destruction of data that is no longer necessary—can mitigate the harm from breaches.[56][57][58] The challenge is that destroying data can be more complex with modern database systems.[59]
Response
[edit]A large number of data breaches are never detected.[60] Of those that are, most breaches are detected by third parties;[61][62] others are detected by employees or automated systems.[63] Responding to breaches is often the responsibility of a dedicated computer security incident response team, often including technical experts, public relations, and legal counsel.[64][65] Many companies do not have sufficient expertise in-house, and subcontract some of these roles;[66] often, these outside resources are provided by the cyber insurance policy.[67] After a data breach becomes known to the company, the next steps typically include confirming it occurred, notifying the response team, and attempting to contain the damage.[68]
To stop exfiltration of data, common strategies include shutting down affected servers, taking them offline, patching the vulnerability, and rebuilding.[69] Once the exact way that the data was compromised is identified, there is typically only one or two technical vulnerabilities that need to be addressed in order to contain the breach and prevent it from reoccurring.[70] A penetration test can then verify that the fix is working as expected.[71] If malware is involved, the organization must investigate and close all infiltration and exfiltration vectors, as well as locate and remove all malware from its systems.[72] If data was posted on the dark web, companies may attempt to have it taken down.[73] Containing the breach can compromise investigation, and some tactics (such as shutting down servers) can violate the company's contractual obligations.[74]
Gathering data about the breach can facilitate later litigation or criminal prosecution,[75] but only if the data is gathered according to legal standards and the chain of custody is maintained.[76] Database forensics can narrow down the records involved, limiting the scope of the incident.[77] Extensive investigation may be undertaken, which can be even more expensive than litigation.[62] In the United States, breaches may be investigated by government agencies such as the Office for Civil Rights, the United States Department of Health and Human Services, and the Federal Trade Commission (FTC).[78] Law enforcement agencies may investigate breaches[79] although the hackers responsible are rarely caught.[80]
Notifications are typically sent out as required by law.[81] Many companies offer free credit monitoring to people affected by a data breach, although only around 5 percent of those eligible take advantage of the service.[82] Issuing new credit cards to consumers, although expensive, is an effective strategy to reduce the risk of credit card fraud.[82] Companies try to restore trust in their business operations and take steps to prevent a breach from reoccurring.[83]
Consequences
[edit]For consumers
[edit]After a data breach, criminals make money by selling data, such as usernames, passwords, social media or customer loyalty account information, debit and credit card numbers,[16] and personal health information (see medical data breach).[84] Criminals often sell this data on the dark web—parts of the internet where it is difficult to trace users and illicit activity is widespread—using platforms like .onion or I2P.[85] Originating in the 2000s, the dark web, followed by untraceable cryptocurrencies such as Bitcoin in the 2010s, made it possible for criminals to sell data obtained in breaches with minimal risk of getting caught, facilitating an increase in hacking.[86][87] One popular darknet marketplace, Silk Road, was shut down in 2013 and its operators arrested, but several other marketplaces emerged in its place.[88] Telegram is also a popular forum for illegal sales of data.[89]
This information may be used for a variety of purposes, such as spamming, obtaining products with a victim's loyalty or payment information, identity theft, prescription drug fraud, or insurance fraud.[90] The threat of data breach or revealing information obtained in a data breach can be used for extortion.[16]
Consumers may suffer various forms of tangible or intangible harm from the theft of their personal data, or not notice any harm.[91] A significant portion of those affected by a data breach become victims of identity theft.[82] A person's identifying information often circulates on the dark web for years, causing an increased risk of identity theft regardless of remediation efforts.[80][92] Even if a customer does not end up footing the bill for credit card fraud or identity theft, they have to spend time resolving the situation.[93][94] Intangible harms include doxxing (publicly revealing someone's personal information), for example medication usage or personal photos.[95]
For organizations
[edit]There is little empirical evidence of economic harm from breaches except the direct cost, although there is some evidence suggesting a temporary, short-term decline in stock price.[96] Other impacts on the company can range from lost business, reduced employee productivity due to systems being offline or personnel redirected to working on the breach,[97] resignation or firing of senior executives,[78] reputational damage,[78][98] and increasing the future cost of auditing or security.[78] Consumer losses from a breach are usually a negative externality for the business.[99] Some experts have argued that the evidence suggests there is not enough direct costs or reputational damage from data breaches to sufficiently incentivize their prevention.[100][101]
Estimating the cost of data breaches is difficult, both because not all breaches are reported and also because calculating the impact of breaches in financial terms is not straightforward. There are multiple ways of calculating the cost to businesses, especially when it comes to personnel time dedicated to dealing with the breach.[102] Author Kevvie Fowler estimates that more than half the direct cost incurred by companies is in the form of litigation expenses and services provided to affected individuals, with the remaining cost split between notification and detection, including forensics and investigation. He argues that these costs are reduced if the organization has invested in security prior to the breach or has previous experience with breaches. The more data records involved, the more expensive a breach typically will be.[103] In 2016, researcher Sasha Romanosky estimated that while the mean breach cost around the targeted firm $5 million, this figure was inflated by a few highly expensive breaches, and the typical data breach was much less costly, around $200,000. Romanosky estimated the total annual cost to corporations in the United States to be around $10 billion.[104]
Laws
[edit]Notification
[edit]The law regarding data breaches is often found in legislation to protect privacy more generally, and is dominated by provisions mandating notification when breaches occur.[105] Laws differ greatly in how breaches are defined,[3] what type of information is protected, the deadline for notification,[6] and who has standing to sue if the law is violated.[106] Notification laws increase transparency and provide a reputational incentive for companies to reduce breaches.[107] The cost of notifying the breach can be high if many people were affected and is incurred regardless of the company's responsibility, so it can function like a strict liability fine.[108]
As of 2024[update], Thomas on Data Breach listed 62 United Nations member states that are covered by data breach notification laws. Some other countries require breach notification in more general data protection laws.[109] Shortly after the first reported data breach in April 2002, California passed a law requiring notification when an individual's personal information was breached.[9] In the United States, notification laws proliferated after the February 2005 ChoicePoint data breach, widely publicized in part because of the large number of people affected (more than 140,000) and also because of outrage that the company initially informed only affected people in California.[110][111] In 2018, the European Union's General Data Protection Regulation (GDPR) took effect. The GDPR requires notification within 72 hours, with very high fines possible for large companies not in compliance. This regulation also stimulated the tightening of data privacy laws elsewhere.[112][113] As of 2022[update], the only United States federal law requiring notification for data breaches is limited to medical data regulated under HIPAA, but all 50 states (since Alabama passed a law in 2018) have their own general data breach notification laws.[113]
Security safeguards
[edit]Measures to protect data from a breach are typically absent from the law or vague.[105] Filling this gap is standards required by cyber insurance, which is held by most large companies and functions as de facto regulation.[114][115] Of the laws that do exist, there are two main approaches—one that prescribes specific standards to follow, and the reasonableness approach.[116] The former is rarely used due to a lack of flexibility and reluctance of legislators to arbitrate technical issues; with the latter approach, the law is vague but specific standards can emerge from case law.[117] Companies often prefer the standards approach for providing greater legal certainty, but they might check all the boxes without providing a secure product.[118] An additional flaw is that the laws are poorly enforced, with penalties often much less than the cost of a breach, and many companies do not follow them.[119]
Litigation
[edit]Many class-action lawsuits, derivative suits, and other litigation have been brought after data breaches.[120] They are often settled regardless of the merits of the case due to the high cost of litigation.[121][122] Even if a settlement is paid, few affected consumers receive any money as it usually is only cents to a few dollars per victim.[78][122] Legal scholars Daniel J. Solove and Woodrow Hartzog argue that "Litigation has increased the costs of data breaches but has accomplished little else."[123] Plaintiffs often struggle to prove that they suffered harm from a data breach.[123] The contribution of a company's actions to a data breach varies,[119][124] and likewise the liability for the damage resulting for data breaches is a contested matter. It is disputed what standard should be applied, whether it is strict liability, negligence, or something else.[124]
See also
[edit]- Full disclosure (computer security)
- Medical data breach
- Surveillance capitalism
- Data breaches in India
References
[edit]- ^ a b Solove & Hartzog 2022, p. 5.
- ^ a b Fowler 2016, p. 2.
- ^ a b Solove & Hartzog 2022, p. 41.
- ^ Shukla et al. 2022, pp. 47–48.
- ^ National Academies of Sciences, Engineering, and Medicine 2016, p. 18.
- ^ a b Solove & Hartzog 2022, p. 42.
- ^ a b Fowler 2016, p. 45.
- ^ Joerling 2010, p. 468 fn 7.
- ^ a b Lesemann 2010, p. 206.
- ^ Solove & Hartzog 2022, p. 18.
- ^ Solove & Hartzog 2022, p. 29.
- ^ Solove & Hartzog 2022, pp. 17–18.
- ^ National Academies of Sciences, Engineering, and Medicine 2016, p. 9.
- ^ Crawley 2021, p. 46.
- ^ Fowler 2016, pp. 7–8.
- ^ a b c Fowler 2016, p. 13.
- ^ Fowler 2016, pp. 9–10.
- ^ Fowler 2016, pp. 10–11.
- ^ Kaster & Ensign 2023, p. 355.
- ^ Ablon & Bogart 2017, p. 1.
- ^ a b Ablon & Bogart 2017, p. 2.
- ^ a b Daswani & Elbayadi 2021, p. 25.
- ^ Seaman 2020, pp. 47–48.
- ^ Daswani & Elbayadi 2021, pp. 26–27.
- ^ Sloan & Warner 2019, pp. 104–105.
- ^ Daswani & Elbayadi 2021, p. 19–22.
- ^ Daswani & Elbayadi 2021, p. 15.
- ^ Ntantogian, Malliaros & Xenakis 2019.
- ^ a b Daswani & Elbayadi 2021, pp. 22–23.
- ^ a b Fowler 2016, pp. 19–20.
- ^ a b Sloan & Warner 2019, p. 94.
- ^ Makridis 2021, p. 3.
- ^ Daswani & Elbayadi 2021, pp. 16–19.
- ^ Sloan & Warner 2019, pp. 106–107.
- ^ Daswani & Elbayadi 2021, p. 28.
- ^ Fowler 2016, p. 19.
- ^ Fowler 2016, pp. 18–19.
- ^ Daswani & Elbayadi 2021, pp. 31–32.
- ^ Solove & Hartzog 2022, pp. 69–70.
- ^ Daswani & Elbayadi 2021, pp. 7, 9–10.
- ^ Daswani & Elbayadi 2021, pp. 200–201.
- ^ Daswani & Elbayadi 2021, pp. 203–204.
- ^ Daswani & Elbayadi 2021, p. 205.
- ^ Daswani & Elbayadi 2021, pp. 206–207.
- ^ Fisher et al. 2024, Title page.
- ^ Fisher et al. 2024, p. 2.
- ^ Fowler 2016, p. 210.
- ^ a b Daswani & Elbayadi 2021, p. 217.
- ^ Daswani & Elbayadi 2021, pp. 215–216.
- ^ Tjoa et al. 2024, p. 14.
- ^ Lenhard 2022, p. 53.
- ^ Daswani & Elbayadi 2021, p. 218.
- ^ Daswani & Elbayadi 2021, pp. 218–219.
- ^ Daswani & Elbayadi 2021, pp. 314–315.
- ^ Tjoa et al. 2024, p. 68.
- ^ Lenhard 2022, p. 60.
- ^ Fowler 2016, p. 184.
- ^ Solove & Hartzog 2022, p. 146.
- ^ Tjoa et al. 2024, p. 69.
- ^ Crawley 2021, p. 39.
- ^ Fowler 2016, p. 64.
- ^ a b National Academies of Sciences, Engineering, and Medicine 2016, p. 25.
- ^ Fowler 2016, p. 4.
- ^ Crawley 2021, p. 97.
- ^ Fowler 2016, pp. 5, 32.
- ^ Fowler 2016, p. 86.
- ^ Fowler 2016, p. 94.
- ^ Fowler 2016, pp. 4–5.
- ^ Fowler 2016, pp. 120–122.
- ^ Fowler 2016, p. 115.
- ^ Fowler 2016, p. 116.
- ^ Fowler 2016, pp. 117–118.
- ^ Fowler 2016, p. 119.
- ^ Fowler 2016, p. 124.
- ^ Fowler 2016, pp. 81–82.
- ^ Fowler 2016, p. 83.
- ^ Fowler 2016, p. 128.
- ^ a b c d e National Academies of Sciences, Engineering, and Medicine 2016, p. 22.
- ^ Fowler 2016, p. 44.
- ^ a b Solove & Hartzog 2022, p. 58.
- ^ Fowler 2016, p. 5, 44.
- ^ a b c National Academies of Sciences, Engineering, and Medicine 2016, p. 13.
- ^ Fowler 2016, pp. 5–6.
- ^ Fowler 2016, p. 14.
- ^ Fowler 2016, pp. 12–13.
- ^ Davidoff 2019, "Modern dark data brokers".
- ^ Solove & Hartzog 2022, p. 21.
- ^ Howell, Christian Jordan; Maimon, David (2 December 2022). "Darknet markets generate millions in revenue selling stolen personal data, supply chain study finds". The Conversation. Retrieved 22 April 2024.
- ^ Garkava, Taisiia; Moneva, Asier; Leukfeldt, E. Rutger (2024). "Stolen data markets on Telegram: A crime script analysis and situational crime prevention measures". Trends in Organized Crime. doi:10.1007/s12117-024-09532-6.
- ^ Fowler 2016, pp. 13–14.
- ^ National Academies of Sciences, Engineering, and Medicine 2016, p. 27.
- ^ National Academies of Sciences, Engineering, and Medicine 2016, pp. 30–31.
- ^ National Academies of Sciences, Engineering, and Medicine 2016, p. 29.
- ^ Solove & Hartzog 2022, p. 56.
- ^ National Academies of Sciences, Engineering, and Medicine 2016, pp. 27–29.
- ^ Makridis 2021, p. 1.
- ^ Fowler 2016, p. 22.
- ^ Fowler 2016, p. 41.
- ^ Sloan & Warner 2019, p. 104.
- ^ Makridis 2021, pp. 1, 7.
- ^ Sloan & Warner 2019, p. 64.
- ^ National Academies of Sciences, Engineering, and Medicine 2016, pp. 8–10.
- ^ Fowler 2016, p. 21.
- ^ National Academies of Sciences, Engineering, and Medicine 2016, p. 10.
- ^ a b Solove & Hartzog 2022, p. 10.
- ^ Solove & Hartzog 2022, p. 43.
- ^ Solove & Hartzog 2022, p. 44.
- ^ Solove & Hartzog 2022, p. 45.
- ^ Thomas 2023, pp. xxvii, xxix, xxxii–xxxiii, xxxiv.
- ^ Lesemann 2010, pp. 206–207.
- ^ Joerling 2010, pp. 468–469.
- ^ Seaman 2020, pp. 6–7.
- ^ a b Solove & Hartzog 2022, p. 40.
- ^ National Academies of Sciences, Engineering, and Medicine 2016, p. 24.
- ^ Talesh 2018, p. 237.
- ^ Solove & Hartzog 2022, p. 48.
- ^ Solove & Hartzog 2022, pp. 48–49.
- ^ Solove & Hartzog 2022, p. 52.
- ^ a b Solove & Hartzog 2022, p. 53.
- ^ Fowler 2016, p. 5.
- ^ Fowler 2016, p. 222.
- ^ a b Solove & Hartzog 2022, pp. 55, 59.
- ^ a b Solove & Hartzog 2022, p. 55.
- ^ a b National Academies of Sciences, Engineering, and Medicine 2016, p. 23.
Sources
[edit]- Ablon, Lillian; Bogart, Andy (2017). Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits (PDF). Rand Corporation. ISBN 978-0-8330-9761-3.
- Crawley, Kim (2021). 8 Steps to Better Security: A Simple Cyber Resilience Guide for Business. John Wiley & Sons. ISBN 978-1-119-81124-4.
- Daswani, Neil; Elbayadi, Moudy (2021). Big Breaches: Cybersecurity Lessons for Everyone. Apress. ISBN 978-1-4842-6654-0.
- Davidoff, Sherri (2019). Data Breaches: Crisis and Opportunity. Addison-Wesley Professional. ISBN 978-0-13-450772-9.
- Fisher, William; Craft, R. Eugene; Ekstrom, Michael; Sexton, Julian; Sweetnam, John (2024). Data Confidentiality: Identifying and Protecting Assets Against Data Breaches (PDF) (Report). NIST Special Publications. National Institute of Standards and Technology.
- Fowler, Kevvie (2016). Data Breach Preparation and Response: Breaches are Certain, Impact is Not. Elsevier Science. ISBN 978-0-12-803451-4.
- Joerling, Jill (2010). "Data Breach Notification Laws: An Argument for a Comprehensive Federal Law to Protect Consumer Data". Washington University Journal of Law and Policy. 32: 467.
- Kaster, Sean D.; Ensign, Prescott C. (2023). "Privatized espionage: NSO Group Technologies and its Pegasus spyware". Thunderbird International Business Review. 65 (3): 355–364. doi:10.1002/tie.22321.
- Lenhard, Thomas H. (2022). Data Security: Technical and Organizational Protection Measures against Data Loss and Computer Crime. Springer Nature. ISBN 978-3-658-35494-7.
- Lesemann, Dana J. (2010). "One More unto the Breach: An Analysis of Legal, Technological, and Policy Issues Involving Data Breach Notification Statutes". Akron Intellectual Property Journal. 4: 203.
- Makridis, Christos A (2021). "Do data breaches damage reputation? Evidence from 45 companies between 2002 and 2018". Journal of Cybersecurity. 7 (1). doi:10.1093/cybsec/tyab021.
- National Academies of Sciences, Engineering, and Medicine (2016). "Forum on Cyber Resilience Workshop Series". Data Breach Aftermath and Recovery for Individuals and Institutions: Proceedings of a Workshop. National Academies Press. ISBN 978-0-309-44505-4.
{{cite book}}
: CS1 maint: multiple names: authors list (link) - Ntantogian, Christoforos; Malliaros, Stefanos; Xenakis, Christos (2019). "Evaluation of password hashing schemes in open source web platforms". Computers & Security. 84: 206–224. doi:10.1016/j.cose.2019.03.011.
- Seaman, Jim (2020). PCI DSS: An Integrated Data Security Standard Guide. Apress. ISBN 978-1-4842-5808-8.
- Shukla, Samiksha; George, Jossy P.; Tiwari, Kapil; Kureethara, Joseph Varghese (2022). Data Ethics and Challenges. Springer Nature. ISBN 978-981-19-0752-4.
- Sloan, Robert H.; Warner, Richard (2019). Why Don't We Defend Better?: Data Breaches, Risk Management, and Public Policy. CRC Press. ISBN 978-1-351-12729-5.
- Solove, Daniel J.; Hartzog, Woodrow (2022). Breached!: Why Data Security Law Fails and How to Improve it. Oxford University Press. ISBN 978-0-19-094057-7.
- Talesh, Shauhin A. (2018). "Data Breach, Privacy, and Cyber Insurance: How Insurance Companies Act as "Compliance Managers" for Businesses". Law & Social Inquiry. 43 (2): 417–440. doi:10.1111/lsi.12303.
- Thomas, Liisa M. (2023). Thomas on Data Breach: A Practical Guide to Handling Data Breach Notifications Worldwide (PDF). Thomson Reuters. ISBN 978-1-7319-5405-3.
- Tjoa, Simon; Gafić, Melisa; Kieseberg, Peter (2024). Cyber Resilience Fundamentals. Springer Nature. ISBN 978-3-031-52064-8.