GAO: Lots of data breaches, not a lot of fraud
5343
Blog: Auditors say only a fraction of largest intrusions in recent years showed clear evidence of resulting identity theft, but they admit that's not always easy to gauge.
679026
A backup tape containing credit-card information from hundreds of U.S. retailers is missing, forcing the company responsible for the data to warn customers that they may become the targets of data fraud.GE Money, which manages in-store credit-card programs for the majority of U.S. retailers, first realized that the tape was missing from an Iron Mountain secure storage facility in October, said Richard Jones, a company spokesman. &quot;We were informed that one of the tapes could not be located. But at the same time, there was no record of it ever having been checked out,&quot; he said.The tape contained in-store credit-card information on 650,000 retail customers, including those of J.C. Penney, he said. GE Money employees are also affected by the breach.The missing backup tape was unencrypted.Although J.C. Penney was the only company that Jones would confirm as affected by the missing tape, that retailer accounts for just a small percentage of all accounts that were compromised. In total, 230 retailers are affected by the breach. &quot;Clearly that number includes many of the national retail organizations,&quot; he said.The tape also contained Social Security numbers of 150,000 customers. When matched with name and address information, Social Security numbers can be used to set up fraudulent credit-card accounts, a common form of identity theft.Jones said that following a GE Money investigation, there is no evidence that the tape in question has been stolen or that the data it contained was misused.After reconstructing the data that was on the missing tape, GE Money began sending out letters to those affected by the breach in December. The company has set up a toll-free number and is offering one year of free credit monitoring services to those affected by the breach.In 2006, retailer TJ Maxx discovered that thieves had&#160;broken into its computer networks, stealing an estimated 94 million credit- and debit-card numbers. Costs related to that breach are expected to be in the hundreds of millions of dollars.GE Money is a division of General Electric.
63557
Attorney Eric J. Sinrod says the statistics belie the general impression that people are taking privacy precautions when they go online.
388261
(InfoWorld) - An overwhelming percentage of businesses still fall far short in their efforts to comply with industry data-handling regulations and reduce their likelihood of experiencing a serious leakage incident, according to a new survey. In a report to be published by the IT Policy Compliance Group on July 18, the consortium of IT compliance and security experts concludes that some 90 percent of all businesses still do not have sufficient policies in place to meet data governance regulations and adequately limit the risk of a breach. In the survey of 475 companies, a third of whom reported revenues of more than $1 billion last year, the industry group found that an overwhelming majority of the firms expect to deal with at least six business disruptions related to major data incidents per year along with five or more instances of information loss or theft. While businesses continue to invest policy enforcement software, and other technologies aimed at helping them meet data-handling regulations, said James Hurley, managing director of IT Policy Compliance Group, most are still struggling to fill all the gaps left in their systems that leave them open to potential incidents. Hurley is also a senior research manager at security software maker Symantec, a member of the compliance policy think tank, along with such organizations as the Computer Security Institute, Institute of Internal Auditors, ISACA, and IT Governance Institute. Along with well-known federal guidelines, such as the Sarbanes-Oxley Act, many companies are having trouble responding to new statewide data protection measures crafted after the California 1386 bill, which requires businesses to make public notice of severe data incidents, he said. "When it comes to protecting data, a lot of organizations still find information all over the place that they may not even have control over," Hurley said. "People are finally discovering this is a difficult problem and that the controls they thought they have in place may not be adequate; that they need to rethink those controls and find out where the data inventory actually is because in most organizations, it's not under control." In addition to gauging what percentage of companies remain at risk for a data breach, the survey also attempted to measure the impact of such an event on the average company. Based on its respondents' replies, businesses that are forced to report major incidents publicly can expect to experience an 8 percent loss of their stock price and an equal 8 percent of their customers. Companies can also expect to report an 8 percent falloff in their quarterly revenue along with additional costs for litigation, customer notification, and subsequent settlements averaging $100 per each record they lose. In a nod to the increased challenge of meeting regulations and lowering data leakage within enterprises, the report concludes that larger companies are more likely to have incidents, based on its research. Organizations with less than 1,000 workers average roughly 8 percent in revenue and customer losses per event, whereas companies with more than 100,000 employees can expect to lose 12 percent of their sales and clientele. While some researchers have tried previously to divine the overall expense of having a major data breach, such as the one reported by retailer TJX Companies in early 2007, it has been hard to guess just how much such an event truly costs said Mike Money, associate director at Protiviti, an auditing services specialist that is also participating in the consortium. "We finally have some data on this because of the state laws that have gone into effect, so hopefully some companies see this report and understand the extent of the problem," Money said. "People are finally starting to focus on the issue because they see the newspaper headlines every day, and until you've been through one of these types of events, it's hard to understand all the implications." Unsurprisingly, the report also finds that companies that allocate the highest budgets for compliance automation technologies are faring better in their efforts than those who spend less on the issue. In a shift from previous studies completed by IT Policy Compliance Group, however, it appears that most organizations are realizing they need to adjust their budgets to account for the tools, Hurley said. "The difference is that these state regulations have put this on the front of the radar screen, and they are realizing that they need to spend money to solve security problems that benefit compliance goals," said Hurley. "There's a clear linkage between having better controls and experiencing fewer data losses and business disruptions, as obvious as that may seem."
612837
The loss or theft of personal data such as credit card and Social Security numbers soared to unprecedented levels in 2007, and the trend isn't expected to turn around anytime soon as hackers stay a step ahead of security and laptops disappear with sensitive information.
348316
But security experts point out that nondisclosure of flaws doesn't necessarily increase security risk.
174087
When data breach investigator Bryan Sartin gets a call to check into an incident involving customer records loss at a retailer, he knows that the situation most likely involves information that has been lifted from a company's point-of-sale systems.
761336
In July Pfizer discovered a data breach that took place last year, informed employees only recently.
376912
Blog: Government auditors say only a fraction of the largest intrusions in recent years showed clear evidence of resulting identity theft, but they admit that's not always easy to gauge.
610632
(InfoWorld) - Despite widespread media coverage of data breaches over the past year, identity fraud is actually dropping in the U.S., Javelin Strategy & Research Inc. reported Thursday. In fact, the cost of identity fraud was down 12 percent from Javelin's 2006 survey, at an estimated US$49.3 billion in losses. The number one source of ID fraud? A lost or stolen credit card. "ID fraud is down," said James VanDyke, Javelin's president and founder. "It hasn't been growing for several years, but we hadn't seen it drop." Nationwide, there were about 500,000 fewer victims, according to this year's survey, VanDyke said. Much of the drop can be attributed to improved antifraud practices on the part of consumers and businesses, he said. "Businesses are doing a better job of not granting new accounts [to criminals]," he said. And consumers are also monitoring their account activity more closely and reporting suspicious transactions to the banks much more quickly. Javelin based its findings on 5,000 telephone interviews with U.S residents conducted over three weeks last October. The survey follows a methodology established by the U.S. Federal Trade Commission, which released a similar study back in 2003. The Javelin research was sponsored by CheckFree Corp., Visa USA Inc. and Wells Fargo & Co. The survey's findings are at odds with those of research firm Gartner Inc., which has reported that ID theft is on the rise. But VanDyke says that this is because Javelin's numbers include responses from a wider range of people, including those who lack Internet access. "Thirty percent of people in the U.S. are not on the Internet, and those people have a vastly different way of managing their finances," he said. According to Javelin, there are also important differences between the way rich and poor people react to ID theft, something that VanDyke describes as a "fraud detection digital divide." "The low-income people essentially run away from purchases and they run away from the Internet," Van Dyke said. Affluent people, on the other hand, tend to embrace the Internet as a way to avoid having sensitive data stolen from the mail, and to keep tabs on their account activity, he said. Mail theft accounted for about 9 percent of all ID compromises. That's more victims than data breaches and phishing combined, according to Javelin's numbers. Javelin also found that young adults between the ages of 18 and 24 were at greater risk of ID theft, with more than 5 percent of respondents having been victimized. "They're being haphazard and as a result, they're being victimized," VanDyke said. "They're not protecting their PCs with antivirus software and firewalls.
318831
(InfoWorld) - The communications network used to transmit medical data for the U.S. government's Medicare and Medicaid programs has security vulnerabilities that could expose patients' medical data and other personal information, according to a report released Tuesday. The report, released by the U.S. Government Accountability Office (GAO), identified 47 weaknesses in the way the U.S. Centers for Medicare and Medicaid Services' (CMS) used a WAN (wide-area network) operated by an unnamed contractor. CMS uses the network to transmit claims data -- including patient names, dates of birth, Social Security numbers, addresses and medical information -- to health-care facilities, contractors, financial institutions, and state Medicaid offices. "A security breach in this communication network could lead to interruptions in the processing of medical claims or to unauthorized access to personally identifiable medical data, seriously diminishing the public's trust in CMS's ability to protect the sensitive beneficiary data it is entrusted with," the GAO said in the report. GAO, in its review of CMS security procedures early this year, found that the agency and contractor did not use adequate identification and authentication controls for access to the network, did not restrict user access to only those programs and files workers need, did not close off all access from the private network to the Internet and did not consistently encrypt sensitive data. CMS did not always ensure security policies it has in place, GAO said. "CMS did not always ensure that its contractor effectively implemented controls designed to prevent, limit, and detect electronic access to sensitive computing resources and to devices used to support the communication network," the GAO said. GAO gave CMS an early copy of the report, and Dr. Mark McClellan, CMS administrator, said in a July 10 letter the agency took quick action to fix the problems. CMS, working with its contractor, had fixed 22 of the 47 vulnerabilities identified by the July letter, and an additional 14 were scheduled to be fixed within weeks. The final 11 vulnerabilities were "somewhat more complex" and were scheduled to be fixed by Jan. 7, he wrote. "We are taking further steps to assure that none result in actual security breaches," McClellan added. "We have been proactive in our oversight of the network but are taking further steps to enhance security." GAO does not typically name contractors in its reports because its focus is on agency performance, a GAO spokesman said. A CMS spokesman said he did not know which contractor was involved in the network targeted by the GAO report. CMS uses multiple contractors, he said. The Medicare program is the nation's largest health-insurance program, covering 42 million U.S. citizens.
343718
Reports of data theft often conjure up images of malicious hackers breaking into remote databases to filch Social Security numbers, credit card records and other personal information.
107650
More than 40% of Medicare contractors and state Medicaid agencies have experienced privacy breaches involving personal health information, according to report released yesterday by the Government Accountability Office.
679376
A spouse and a peer-to-peer file-sharing program appear to be at the center of a data breach that exposed information on 17,000 Pfizer employees -- and maybe other individuals as well. Investigators would like to know why it took the company six weeks to reveal the problem.
575194
(InfoWorld) - The U.S. Department of Veterans Affairs has made some progress since aÂ May 2006 data breach, but it has not completed 20 of 22 recommendations from an internal auditor, according to a report released Wednesday. As of May, the VA had not yet addressed several "critical success factors" for transforming its IT management, the U.S. Government Accountability Office said in its report. The VA had only completed two of 22 recommendations from its inspector general following the breach, in which a laptop and hard drive containing personal records of 26.5 million veterans and family members were stolen from a VA employee's home. The VA also needs to improve its IT asset control, the GAO said, referencing a July report showing about 2,400 missing IT devices at four VA locations in 2005 and 2006. While the VA has "many significant initiatives under way," problems persist even in the programs meant to fix past problems, the GAO report said. "We continue to see management weaknesses in these programs and initiatives, which are the very weaknesses that VA aims to alleviate," the GAO report said. The VA has not completed a comprehensive security management program recommended by the GAO, and it has not strengthened its critical infrastructure planning process, which was recommended by its inspector general, the GAO said. In addition, the VA has worked with the U.S. Department of Defense for 10 years to share electronic medical records, but the two agencies are "far" from completing that work, the GAO said. Robert Howard, the VA's assistant secretary for information and technology since last September, largely agreed with the GAO report while testifying before the U.S. Senate Veterans Affairs Committee Wednesday. "Since the May 2006 data breach, the VA staff is now more aware of the importance of protecting our veterans' and employees' information and identities," Howard said. "While we do have a way to go here, I have definitely seen improvement." The VA has encrypted more than 18,000 laptops since the breach, and it is rolling out software that blocks unauthorized data storage devices, such as thumb drives, from connecting to the VA's network, he said. The agency has also installed software that blocks VA employees from sending e-mail containing Social Security numbers, he said. As the VA was rolling out the e-mail filtering software, the software caught about 7,000 e-mails containing Social Security numbers in just one month, Howard said. The VA is also in the process of centralizing its long-criticized location-based IT structure, and the agency's goal is to compete the realignment by July, Howard said. Senator Daniel Akaka, a Hawaii Democrat and committee chairman, noted that VA Secretary of Veterans Affairs Jim Nicholson promised the agency would become a "gold standard" for cybersecurity following the 2006 breach. "How close is VA to becoming the government leader in information security?" Akaka said. Howard recounted some of the agency's progress, but said there's still work to do. "I don't know, to be honest with you," he said. "We hope to be very close by the end of this fiscal year." Howard also talked about seven major priorities, including a "well-led, high-performing IT organization." Senator Richard Burr, a North Carolina Republican, asked Howard to rate each priority on a scale from one to 10, with 10 meaning fully completed. Howard's progress ratings on some of the priorities: *Â Standardizing its IT infrastructure and business processes: 3 *Â Establishing programs to make the agency's IT system more : 2 or 3 *Â Remedying the agency's "long-standing IT material weaknesses" relating to a lack of security controls: 5 "All this will take some time to put in place," he said.
729347
The U.S. Department of Veterans Affairs has made progress on data security since last May's laptop theft, but still needs to address a variety of shortcomings, government auditors say.
234760
(InfoWorld) - Reports of corporate data leaks, lost laptops, and misplaced backup tapes are so commonplace that many no longer warrant a mention in the press. So common are corporate data leaks of one form or another that only the multimegaton events -- TJX, the Veterans Administration, or DuPont -- get covered. But the data leak problem sure has gotten the attention of corporate boardrooms, even if the media has moved on. For proof of that, look no further than the gaggle of data leak prevention companies that has popped up in recent years. We've already heard this month about startup Provilla, as well as Varonis. Code Green Networks is another aspiring startup that hopes to bring high-end data leak prevention technology to smaller and midsize corporations. Founded in late 2004, Code Green is the brainchild of Shreekampt and Sudhakar Ravi, both co-founders of security appliance maker Sonicwall. Started with seed money from its two founders, the company has taken in $32 million in venture funding to date and now has 65 employees, says Chip Hay, senior vice president for marketing and customer care at Code Green. Data leaks aren't just bad publicity for companies, they're also expensive, Hay says. Citing a recent study by the Ponemon Institute, Hay says that lost customer records can cost as much as $182 each to remediate, not counting penalties and legal ramifications from the growing matrix of state and federal data protection and consumer privacy laws. Those factors have stoked enterprise interest in data protection products. "The big change for us in the last nine months is that we've gone from talking to companies who want to get educated, and now they've decided that [they] want to put data leak prevention in place," Hay says. Companies -- especially in fields such as high technology -- are also paying attention to protecting their core intellectual property, especially with outsourcing and complex business partner relationships exposing more and more data, he says. Code Green's flagship product is a content inspection appliance that's installed at egress points on customer networks. The device can inspect SMTP, e-mail, FTP, and IM traffic, among others, and can run in-line to block suspicious traffic or in asynchronous mode to monitor actions and policy enforcement, Hay says. At the heart of Code Green's technology are algorithms that were originally designed to spot plagiarism in different samples of writing, Hay says. That technology, which analyzes content bit patterns, allows Code Green to spot sensitive information without relying on fallible dictionaries of terms, and without regard to the language used to express the sensitive information. That, and the product's support for more than 400 document formats, allows Code Green to sell into markets like Japan and China, Hay says. That's increasingly important, amid concern about rampant intellectual property theft -- some of it state sponsored. For example, one Code Green customer recently reported finding proprietary manufacturing process documents published in a Chinese language publication, Hay says. The company also prides itself on its product's capability to parse message traffic from the sea of Web-based e-mail providers, where no standard message formats are used. Code Green has also forged strategic partnerships with vendors such as Voltage Security for e-mail encryption and with Centennial Software to reach the SMB market. A new version of the Code Green appliance due out soon will offer enhanced data fingerprinting for reading data in relational databases, and structured and flat files -- as well as better content discovery features. The product already sports connectors to Oracle and Microsoft SQL server and EMC's Documentum content management platform.