Data breach

From Wikipedia, the free encyclopedia - View original article

Jump to: navigation, search

A data breach is the intentional or unintentional release of secure information to an untrusted environment. Other terms for this phenomenon include unintentional information disclosure, data leak and also data spill. Incidents range from concerted attack by black hats with the backing of organized crime or national governments to careless disposal of used computer equipment or data storage media. Definition "A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so." Data breaches may involve financial information such as credit card or bank details, personal health information (PHI), Personally identifiable information (PII), trade secrets of corporations or intellectual property. According to the nonprofit consumer organization Privacy Rights Clearinghouse, a total of 227,052,199 individual records containing sensitive personal information were involved in security breaches in the United States between January 2005 and May 2008, excluding incidents where sensitive data was apparently not actually exposed.[1]


This may include incidents such as theft or loss of digital media such as computer tapes, hard drives, or laptop computers containing such media upon which such information is stored unencrypted, posting such information on the world wide web or on a computer otherwise accessible from the Internet without proper information security precautions, transfer of such information to a system which is not completely open but is not appropriately or formally accredited for security at the approved level, such as unencrypted e-mail, or transfer of such information to the information systems of a possibly hostile agency, such as a competing corporation or a foreign nation, where it may be exposed to more intensive decryption techniques.[2]

ISO/IEC 27040 defines a data breach as: compromise of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to protected data transmitted, stored or otherwise processed.

Trusted environment[edit]

The notion of a trusted environment is somewhat fluid. The departure of a trusted staff member with access to sensitive information can become a data breach if the staff member retains access to the data subsequent to termination of the trust relationship. In distributed systems, this can also occur with a breakdown in a web of trust.

Data privacy[edit]

Most such incidents publicized in the media involve private information on individuals, i.e. social security numbers, etc.. Loss of corporate information such as trade secrets, sensitive corporate information, details of contracts, etc. or of government information is frequently unreported, as there is no compelling reason to do so in the absence of potential damage to private citizens, and the publicity around such an event may be more damaging than the loss of the data itself.

Insider versus external threats[edit]

Those working inside an organization are a major cause of data breaches. Estimates of breaches caused by accidental "human factor" errors range from 37% by Ponemon Institute[3] to 14% by the Verizon 2013 Data Breach Investigations Report.[4] The external threat category includes hackers and state-sponsored actors. Professional associations for IT asset managers[5] work aggressively with IT professionals to educate them on best risk-reduction practices for both internal and external threats to IT assets, software and information.

Medical data breach[edit]

Some celebrities have found themselves to be the victims of inappropriate medical record access breaches, albeit more so on an individual basis, not part of a typically much larger breach.[6] Given the series of medical data breaches and the lack of public trust, some countries have enacted laws requiring safeguards to be put in place to protect the security and confidentiality of medical information as it is shared electronically and to give patients some important rights to monitor their medical records and receive notification for loss and unauthorized acquisition of health information. The United States and the EU have imposed mandatory medical data breach notifications.[7]

Average cost of data breach in Germany[8]


Although such incidents pose the risk of identity theft or other serious consequences, in most cases there is no lasting damage; either the breach in security is remedied before the information is accessed by unscrupulous people, or the thief is only interested in the hardware stolen, not the data it contains. Nevertheless, when such incidents become publicly known, it is customary for the offending party to attempt to mitigate damages by providing to the victims subscription to a credit reporting agency, for instance, new credit cards, or other instruments. In the case of Target, the 2013 breach cost Target a significant drop in profit, which dove an estimated 40 percent in the 4th quarter of the year.[9]

Major incidents[edit]

Notable incidents include:










See also[edit]


  1. ^ a b c d e f g h i j k "Chronology of Data Breaches", Privacy Rights Clearinghouse
  2. ^ When we discuss incidents occurring on NSSs, are we using commonly defined terms?, "Frequently Asked Questions on Incidents and Spills", National Archives Information Security Oversight Office
  3. ^ Risk of Insider Fraud: Second Annual Study. (2013-02-28). Retrieved on 2014-06-10.
  4. ^ Verizon Data Breach Investigations Report | Verizon Enterprise Solutions. Retrieved on 2014-06-10.
  5. ^ Welcome to IAITAM. Retrieved on 2014-06-10.
  6. ^ Ornstein, Charles (2008-03-15). "Hospital to punish snooping on Spears". Los Angeles Times. Retrieved 2013-07-26. 
  7. ^ Kierkegaard, P. (2012) Medical data breaches: Notification delayed is notification denied, Computer Law & Security Report , 28 (2), p.163–183.
  8. ^ "2010 Annual Study: German Cost of a Data Breach" (PDF). Ponemon Institute. February 2011. Retrieved 2011-10-12. 
  9. ^
  10. ^ "Apple Media Advisory: Update to Celebrity Photo Investigation". Business Wire ( September 2, 2014. Retrieved 2014-09-05. 
  11. ^ Melvin Backman (18 September 2014). "Home Depot: 56 million cards exposed in breach". CNNMoney. 
  12. ^ "Staples: Breach may have affected 1.16 million customers' cards". December 19, 2014. Retrieved 2014-12-21. 
  13. ^ Goodin, Dan. (2013-11-01) How an epic blunder by Adobe could strengthen hand of password crackers. Ars Technica. Retrieved on 2014-06-10.
  14. ^ "Target security breach affects up to 40M cards". Associated Press via Milwaukee Journal Sentinel. 19 December 2013. Retrieved 21 December 2013. 
  15. ^ Honan, Mat (2012-11-15). "Kill the Password: Why a String of Characters Can’t Protect Us Anymore". (Condé Nast). Retrieved 2013-01-17. 
  16. ^ Honan, Mat (August 6, 2012). "How Apple and Amazon Security Flaws Led to My Epic Hacking". Retrieved 26 Jan 2013. 
  17. ^ "Protecting the Individual from Data Breach". The National Law Review. Raymond Law Group. 2014-01-14. Retrieved 2013-01-17. 
  18. ^ "Public Incident Response Report". State of South Carolina. 2012-11-12. Retrieved 2014-10-10. 
  19. ^ "South Carolina: The mother of all data breaches". The Post and Courier. 2012-11-03. Retrieved 2014-10-110.  Check date values in: |accessdate= (help)
  20. ^ Greenberg, Andy (9 June 2011). "Citibank Reveals One Percent Of Credit Card Accounts Exposed In Hacker Intrusion". Forbes. Retrieved 2014-09-05. 
  21. ^ Making Business a Little Less Risky: The Convergence of Data, Identity, and Regulatory Risks. (2011-06-13). Retrieved on 2014-06-10.
  22. ^ Heartland Payment Systems Uncovers Malicious Software In Its Processing System
  23. ^ Lessons from the Data Breach at Heartland, MSNBC, July 7, 2009
  24. ^ GE Money Backup Tape With 650,000 Records Missing At Iron Mountain - Iron Mountain
  25. ^ BNP activists' details published - BBC News
  26. ^ "Bank of America settles Countrywide data theft suits"
  27. ^ "Countrywide Sued For Data Breach, Class Action Suit Seeks $20 Million in Damages", Bank Info Security, April 9, 2010
  28. ^ "Countrywide Sold Private Info, Class Claims", Courthouse News, April 05, 2010
  29. ^ "The Convergence of Data, Identity, and Regulatory Risks", Making Business a Little Less Risky Blog
  30. ^ Manning, Jeff (2010-04-13). "D.A. Davidson fined over computer security after data breach". The Oregonian. Retrieved 2013-07-26. 
  31. ^ "T.J. Maxx data theft worse than first reported". 2007-03-29. Retrieved 2009-02-16. 
  32. ^ data Valdez Doubletongued dictionary
  33. ^ AOL's Massive Data Leak, Electronic Frontier Foundation
  34. ^ data Valdez, Net Lingo
  35. ^ "Active-duty troop information part of stolen VA data", Network World, June 6, 2006

External links[edit]