Report: Data breaches don't often result in ID theft
111329
A report released Thursday by the GAO indicates that just one-sixth of the 24 largest data breaches reported between January 2000 and June 2005 resulted in actual identity theft. The report could give support to those who want breach-notification rules eased.
427479
The United States plans to issue passports with personal data stored on radio frequency identification chips. The documents would be harder to forge, but might leave holders vulnerable to identity theft. By Ryan Singel.
162029
Rise in online identity fraud has companies on the hook: Educate customers or lose them.
376912
Blog: Government auditors say only a fraction of the largest intrusions in recent years showed clear evidence of resulting identity theft, but they admit that's not always easy to gauge.
434215
(InfoWorld) - Contrary to popular perception, computer data breaches are less likely to result in identity theft and other fraud than off-line causes such as lost or stolen wallets and checkbooks. That was the finding of a year-long study of about 5,000 U.S. consumers by Pleasanton, Calif.-based analyst firm Javelin Strategy & Research. Javelin's research showed that despite recent hype, data breaches were responsible for just 6 percent of all known cases of identity theft, compared to 30 percent from incidents like losing one's wallet. The study also showed that less than 1 percent of all individuals whose data was lost later became victims of ID theft. Javelin's results are similar to those found by other firms that have looked at the relationship between data breaches and actual instances of ID fraud. In a Gartner study in 2005, for instance, only 18 percent of identity theft victims attributed the cause to computer breaches, while 41 percent cited off-line causes. Similarly, a December 2005 analysis by ID Analytics Inc. of four major online data breaches involving 500,000 customer records showed that less than 1 percent of those affected had their identities stolen. The numbers are important at a time when a spate of data breach disclosures has heightened consumer concerns and is fueling a debate among lawmakers about the need for more stringent data protection laws, analysts said. "There is a misperception that there is a one-to-one correlation between a data breach and ID theft," said Thomas Oscherwitz, vice president of government affairs and chief privacy officer at San Diego-based ID Analytics. In reality, "the mere fact that you are part of a data breach doesn't mean that you are a victim of ID theft," he said. The degree of risk can depend on the type of breach, Oscherwitz said. Data breaches involving a deliberate hacking, for instance, are likely to be much more risky than those involving a lost disk or laptop, he said. Failing to make such distinctions can push consumers to undertake unnecessary efforts to protect themselves and can impose burdens on corporations, said Mary Monahan, author of the Javelin study. "Our opinion is that consumers do need to be protected by data breach laws, and we do want to see a federal law to protect all consumers," Monahan said. But given the low risk of ID theft from such breaches, any such law would need to give the breached entity the opportunity to conduct a risk assessment before they are required to disclose it publicly; The absence of such a trigger could result in indiscriminate notifications. "And then all you get is white noise" that few people pay attention to, Monahan said. Currently, many of the 30-plus states that have breach disclosure laws require companies to notify customers of any data breach involving the potential compromise of personally identifiable information. Several industry groups have been lobbying lawmakers for a preemptive federal law that would add some sort of a breach notification trigger that is based on an assessment of the risk of ID theft or other fraud. Privacy advocates, on the other hand, have been arguing for broad disclosure, saying that few companies are likely to publicly notify consumers of a breach if they are allowed to make their own risk assessments. "I think it's always going to be difficult to make a conclusive cause-and-effect relationship between ID theft and data breaches," said Andrew Jacquith, an analyst at Yankee Group Research Inc. in Boston. So the real emphasis of any national legislation has to be on measures that companies need to take to protect sensitive customer data, he said. Also important is the need to examine issues like the continuing use of Social Security numbers as identifiers by a large number of companies, Jacquith said. "I view nonpublic information as radioactive material that needs to be protected [from leaks]," he said. "It's material that you can use to manufacture identities with."
85636
The FBI said that 160 laptop computers were lost or stolen in less than four years, including at least 10 that contained sensitive or classified information -- one of which held "personal identifying information on FBI personnel," according to a report released yesterday.
82436
Most Britons are taking precautions against identity fraud, a new survey has found.
760540
(InfoWorld) - Identity theft remained top of mind among U.S. consumers last year, but complaints about Internet auction fraud dropped noticeably, according to data released Wednesday by the U.S. Federal Trade Commission (FTC). More than a quarter of a million ID theft complaints were lodged with the agency last year, accounting for 36 percent of the 674,000 complaints the FTC received. That number is down slightly from 2005, when ID theft accounted for 37 percent of all complaints. This marks the seventh consecutive year that identity theft has been ranked number one. The second-largest number of complaints, 7 percent, came from consumers who were unhappy with products they had ordered from catalogs. Internet-related complaints were up too. According to the 2006 data, they made up 60 percent of all fraud complaints. Last year, they accounted for 46 percent. But one area of Internet fraud declined noticeably: Internet auctions. In last year's report, complaints relating to products purchased on online auction sites like eBay made up 12 percent of the FTC submissions. In the 2006 numbers released Wednesday, that number had plummeted to 5 percent. The FTC has made identity theft a priority over the past few years, and the agency maintains a Web site where consumers can learn how to protect themselves and file complaints if they've been victimized. The FTC is also one of the agencies heading up the U.S. government's Identity Theft Task Force, created by President George Bush in 2006. "It's not surprising to me that identity theft is number one because we're the ID theft clearinghouse," said FTC Chairman Deborah Platt Majoras. The fact that the FTC saw a slight drop in the percentage of its complaints that related to ID fraud appears to back upÂ a downward trend reported last week by Javelin Research. The research firm said that ID fraud was down in the U.S. with the cost of this type of crime dropping 12 percent in 2006. The FTC stressed that its consumer complaints data is merely anecdotal. However, the agency is working on a more rigorous study of identity fraud trends and is expected to release that data in the coming months. Majoras said it was unclear whether ID fraud is increasing but hopes that the Javelin numbers are right. Her sister was the victim of identity theft recently after falling prey to a phishing attack, she said. "I said to her, 'You can't fall for stuff like that,'" she said. Â
139875
Company says breach last week by hackers likely had no impact on customers, but it continues to investigate the incident.
119821
Eager to get into the identity-theft business? Don't bother breaking into a government employee's house or staking out an unsecured Wi-Fi hotspot. A recent study shows that a simple shopping jaunt on eBay or in a local used-tech store will pay off in personal info over half the time.
675654
Although online shopping has its risks, your credit-card number and other personal information are just as likely to be stolen in a very low-tech way.
207163
Thousands of credit card numbers and other personal data may have been compromised.
160385
A report by the Army's inspector general concludes that a controversial data-mining project involving airline passenger records did not violate federal privacy law. Critics say the report misinterprets the law. By Ryan Singel.
257661
Think you're safe from identity theft on campus? Think again.   College students face about the same risk of having their identity stolen as the average person -- roughly one in 30.
764890
Identity thieves are typically young, work solo and rely on the Internet for fewer than one-fifth of their crimes, according to a new study of Secret Service cases.
548024
In a recent interview, privacy advocate Marc Rotenberg said it isn't clear how government agencies or companies will use the personal data that they collect via things such as identity and shopping courtesy cards.
96533
Incidents of identity theft are decreasing, and the average loss as a result of fraud has dropped, a new study suggests. The improvement may reflect a higher awareness of the problem by consumers and businesses, say experts.