[BreachExchange] More Than 20 Data Breaches Reported Per Day in First Half of 2019

[Destry Winant]

https://www.darkreading.com/attacks-breaches/more-than-20-data-breaches-reported-per-day-in-first-half-of-2019/d/d-id/1335538

But incidents involving SSNs, addresses, birth dates were smaller than
in previous years.

If data breach reports evoke a sense of déjà vu these days, it's only
because breaches have almost unfailingly kept increasing in number and
becoming bigger in scope quarter after quarter, year in and year out.
However, the raw numbers do not always tell the full story.

Risk Based Security's just-released data breach report for the first
six months of this year reveals a total of 3,813 breaches were
reported from January 1 through June 30—or on average, more than 20 of
them each day.

Combined, the breaches exposed over 4.1 billion records containing
Social Security numbers, bank account and payment card information,
full names, birthdates, addresses, and other sensitive information.
The total number of breaches in the first half of 2019 was 54% higher
than during the same period last year, while the number of exposed
records was 52% more than 2018.

The data shows that organizations still face too many blind spots in
their security operations, says Inga Goddijn, executive vice president
at Risk Based Security. "Clearly despite the increased spending,
resources are still spread too thin and there are too many holes going
unfilled."

While the broad breach numbers are consistent with patterns in almost
every single quarter and six-month period for the past several years,
Risk Based Security's data showed that some things might be changing.

For instance, fewer records were exposed in data breaches involving
Social Security numbers, names, birth dates, and addresses—all
critical components for identify theft—this year compared to two years
ago.

Only 11% of the exposed records during the first half of 2019 were
SSNs compared to 22% last year and 27% in 2017. Similarly, just 8% and
11%, respectively, of the breached records involved birth dates and
addresses, compared to 13% and 22% last year.

Similarly, for all the heightened concern around breaches caused by
third parties, the data shows that in the first-half of this year
there were fewer of them compared to the same period over the last
five years.

In the first six months of 2019, a total of 137 breaches exposed
sensitive third-party data. In comparison, there were 173 such
incidents during the same period last year, 151 in 2017 and 169 in
2016. The number of records exposed in the breaches involving
third-party data was also less than half of last year, and about
one-third that of 2017.

Big Breaches, Big Exposures

The biggest breaches in the first six months of this year included one
at Verifications.Io that exposed a mind-numbing 983 million records
with all sorts of sensitive information; another at First American
Financial Corp that impacted 885 million records; and one at an
unknown organization that leaked personally identifiable information
on some 275 million Indian citizens.

Just eight such mega-breaches accounted for 3.2 billion, or 78.6%, of
the total number of records that were compromised in the first half of
this year. More than seven-in-10 (70.5%) of the breaches exposed email
addresses, and 64.2% exposed passwords -- a sign of the high-level of
attacker interest in obtaining credentials for use in future malicious
activities.

There were far fewer Web breaches (162) than there were incidents of
unauthorized access to systems and services by external hackers
(3,128). Yet, Web breaches were responsible for more than 80%, or 3.3
billion, of the records that were exposed in the first half of 2019.

As has been the case for sometime, organizations in the healthcare,
retail, finance, and IT sectors reported significantly more data
breaches than firms in almost every other industry.

"Perfect security is impossible," Goddijn says. But taking a more
risk-focused approach to cybersecurity can help organizations address
critical gaps, she says. That includes having a good handle on your
most critical assets and knowing where your sensitive data resides,
Goddijn notes. "It also includes leveraging high-quality data in order
to understand where the weak spots are in order to make more informed
decisions about how to address those spots."