Let’s get serious about security: 2.6 billion records stolen or compromised in 2017

Gemalto, my employer, recently published the latest research from its Breach Level Index (BLI), sharing that 2.6 billion records were stolen, lost or exposed worldwide during the year of 2017. A global database, the BLI follows and studies breaches, the types of data compromised and how it was accessed or lost.

Comparing the figure to the previous year in 2016, the number has soared by an astounding 88 percent. Even though incidents fell by 11 percent, 2017 was the first year where publicly disclosed breaches surpassed the two-billion mark since the BLI began tracking breaches. In total, nearly 10 billion records have been lost, stolen, or exposed within the past five years. This rounds out to an estimated five million records per day.

A look at the numbers

The BLI reported 1,765 incidents in all of 2017, and identity theft was recognized as the leading type of data breach – 69% of attacks related to the category. Access to financial data followed as the second most dominant type with 16%. Numbers rose for nuisance breaches by an immense 560%, representing 61% of all compromised records. Nuisance attacks are described as breaches where basic data such as names, addresses and phone numbers are impacted. Consequences of these types of breaches are usually undetermined, but hackers often use this information to coordinate further attacks on organizations.

Since 2016, both existential and account access attacks decreased in incidents and records. Moreover, with seventy -two percent of all breach incidents involving malicious outsiders, they continue to be the number one threat to enterprises. Still, they only accounted for 23% of all compromised data while accidental loss constituted 76% of the data and caused 18% of breaches (a 580% increase). As for malicious insider attacks, they accounted for 9 percent of the total amount of cases. Though, from 2016, this breach source saw intense growth as 30 million records were either stolen or compromised, an increase of 117%.

Affected industries

According to the BLI, a few industries experienced a large number of incidents including healthcare (27%), financial services (12%) and education (11%) organizations. However, certain sectors seemed to be targeted more in regard to lost, stolen or compromised information such as government (18%), financial services (9.1%) and technology (16%).

Everyday people are another major risk to security because humans are bound to commit errors. This is a serious security issue considering accidental loss caused 1.9 billion records to be exposed. Due to individuals incorrectly disposing records, misconfiguring databases and carrying out other unintentional security offences, numbers have increased significantly from the previous year. Companies must take the time to invest in their employees and provide proper training on access control to avoid the mishandling of their data. Building a vigorous security culture empowers employees to make the right decisions and serve as the front line of defense against breaches and other digital threats.

A well-designed approach to defense

The manipulation of data or data integrity attacks pose an arguably more unknown threat for organizations to combat than simple data theft, as it can allow hackers to alter anything from sales numbers to intellectual property. By nature, data integrity breaches are often difficult to identify and, in many cases,, where this type of attack has occurred, we have yet to see the real impact. In the event that the confidentiality, or privacy, of the data is breached, an organization must have controls, such as encryption, key management and user access management, in place to ensure that integrity of the data isn’t tampered with and it can still be trusted. Regardless of any concerns around manipulation, these controls would protect the data in situ and render it useless the moment it’s stolen.

Businesses can help alleviate many of the risks they face by adopting a security by design approach when developing security protocols and tools. With regulations such as the General Data Protection Regulation and the Australian Privacy Act going into effect, now is the time for organizations to consider these ideas. In order to comply with these new guidelines, enterprises must alter their attitudes on security and protect both their data and the privacy of their customers’ sensitive information.

So, what are the next steps that organizations must take in order to comply and protect themselves? As stated earlier, they’ll need to take control and invest in security. Employees should learn to implement various security measures including encryption, access controls, authentication and more. Also, organizations have to prepare for what many consider to be the inescapability of a digital attack. Rank IT assets and decide what the impact could be on the organization and its resources.

Using all of this knowledge, organizations may shape their security strategy in a manner that suits their needs and put a response plan in place. The point to remember – the core of any security strategy is to protect the data first, then the perimeter.

This article is published as part of the IDG Contributor Network. Want to Join?