How Data is Under Siege like Never Before

Table 2 - Incidents compromising personal data reported in Q1, 2018

Type of Data Exposed

 Figure 2- Number of accounts exposed per type of data, in incidents reported during Q1, 2018 (million users)

During the first quarter of 2018, PII and PHI accounted for the majority (ca. 62%) of data exposed from the incidents reported. The long lasting and high value of PII and PHI makes the exposure more serious and attractive for data thieves than any other type of information. A single PHI file, for example, can yield a profit of up to $20,000. This is mainly because it can take weeks or months for a healthcare data breach to be discovered, enabling cybercriminals to extract much more valuable data. Moreover, because healthcare data can contain dates of birth and Social Security numbers, it is much more difficult or even impossible to change, so data thieves can take advantage of it for a longer period of time. Financial data can be easily monetized by cyber criminals despite the limited life span, representing lesser value in the black market - users once notified can quickly cancel and replace the information.

Incident Disclosure and User Notification

Figure 3 - Number of accounts exposed per type of incident disclosure during Q1 2018 (milllion users)

During the first quarter of 2018, the number of incidents disclosed by affected organizations matched the number conducted by external entities. This fact reveals that still many organizations deliberately hide this information or unintentionally operate deficient systems. A noteworthy fact is that, incidents involving payment information resulted in immediate disclosure and notification of affected users. Moreover, still the majority of users (ca. 57%) were not immediately notified, considered a serious violation of data protection policies. Under the upcoming General Data Protection Regulation (GDPR), data controllers should immediately notify personal data breaches to competent authorities (Data Protection Authorities) and affected individuals.

Recommendations

In June 2016, ENISA produced an info note reviewing massive data breaches and providing recommendations to respond and limit the impact of such data breaches. These recommendations are still valid and applicable to the incidents reported today.

Summary of recommendations for users:

• Register with online services such as haveibeenpwned.com to look for evidences that personal data has been compromised by a data breach.
• Users with personal data exposed, when notified by data keepers or alerted by the media, should immediately change passwords and monitor accounts for fraudulent activity.
• In the event of a financial data breach, contact the financial institution and if necessary immediately cancel debit or credit cards.
• Regularly review the data privacy policy and user settings of subscribed online services.
• Not re-use passwords.
• Use two-factor authentication.

Summary of recommendations for organizations (in line with EU GDPR):

• Adopt security and privacy by design in system, network architecture and software development.
• Maintain processes, controls and policies up-to-date.
• Promote internal awareness and change management.
• Implement data protection systems and processes such as access control, hashing and encryption.
• Assure immediate notification of data breaches to authorities, regulators and affected users.
• Review the requirements for personal data processing and transfer within and outside the organization.
• Define and establish an incident response process for data breaches;

Closing Remarks

The growing number of reported data breaches and volume of data stolen does not necessarily mean that systems are becoming more insecure: affected organizations are operating more transparently and timely, so consumers can be better informed on what are the immediate and long-term impacts to their personal information by any given data breach. Furthermore, the recent Cambridge Analytica/Facebook incident with direct repercussions in U.S. and UK politics, and the future introduction of GDPR are drawing substantial public attention to the data protection topic. However, is still uncertain whether all the awareness and regulation will produce tangible results in building a safe and trustworthy digital environment for the economy and society.

---