Record Data Breaches in 2007, Groups Say
217110
The loss or theft of personal data such as credit card and Social Security numbers soared to unprecedented levels in 2007, and the trend isnât expected to turn around anytime soon.
109036
The University of California, Los Angeles, reports one or more computer hackers have accessed a database containing the personal information of 800,000 people.  The school said the central campus database was accessed between October 2005 and Nov.
359132
Hackers got into a database containing the Social Security numbers of
300502
The personal data of some 237,000 policy holders at Hartford Financial Services Group Inc. -- stored on back-up tapes that were misplaced -- may have been compromised, the company said.
283682
A computer hacker apparently broke into a database, leaving 32,000 people uncertain whether their finances or identities might be compromised.
50902
A consumer advocacy organization says companies and institutions have collectively fumbled roughly 93,754,333 private records in the last two years.
511400
The worst data breach made public so far -- the one that affected customers of TJX Companies -- is even worse than first thought. Court documents indicate that the number of accounts affected is 94 million, more than double initial estimates.
738930
(InfoWorld) - The Cyber Security Industry Alliance has given the U.S. government D grades on its cybersecurity efforts in 2006, and renewed its call for the U.S. Congress to pass a comprehensive data protection law in 2007. The CSIA, a trade group representing cybersecurity vendors, gave the U.S. government D grades in three areas: security of sensitive information, security and reliability of critical infrastructure, and federal government information assurance. "Government needs to take these issues very seriously," said Liz Gasster, the CSIA's acting executive director and general counsel. Among the problems in 2006: The U.S. Department ofÂ Veterans Affairs reported a data breach involving the personal information of 26.5 million military veterans and family members. Other agencies also reported multiple lost laptops containing personal information. The CSIA called on agencies to notify citizens of data breaches. After a rash of reported data breaches in early 2005, members of Congress introduced multiple bills requiring companies with data breaches to notify affected consumers. ButÂ a breach-notification law failed to pass, partly because of jurisdictional fights between multiple congressional committees. A comprehensive data security bill should include breach notification, but also a requirement that all organizations holding sensitive data -- including private companies, government agencies, nonprofits, and educational institutions -- use reasonable security standards, Gasster said. The U.S. Federal Trade Commission has taken action against several companies, but a comprehensive law would give the FTC or another agency broad jurisdiction to investigate data breaches, she said. The CSIA is optimistic a comprehensive data breach law will pass in the next year, even though it stalled in the last Congress, Gasster added. Major data breaches continue to happen, and consumers will increase the pressure on Congress to act, she predicted. In mid-January, retailerÂ TJX Companies Inc. reported a massive data breach. "Consumers just are not going to put up with is," Gasster said. Here's how the CSIA generated its government cybersecurity grades: -- Security of sensitive information, grade D: Congress ratified the Council of Europe Convention on Cyber Crime, allowing the U.S. to work with other signatories on cybersecurity investigations, but failed to pass a comprehensive law to protect sensitive personal information. -- Security and resiliency of the critical information infrastructure, grade D: The Department of Homeland Security appointed an assistant secretary for cybersecurity and telecommunications and implemented some cybersecurity program, but it hasnât offered a clear agenda for its top cybersecurity research and development priorities or established a survivable emergency coordination network to handle a large-scale cybersecurity disaster. -- Federal information assurance, grade D: Government continues to offer a "mixed bag of successes and failures," the CSIA said, with progress within the White House Office of Management and Budget's enforcement of cybersecurity directives and implementation of U.S. President George Bush's Homeland Security Presidential Directive 12, requiring agencies to start issuing smart identification cards. But the government needs to do a better job in several areas, including security issues with telecommuting and releasing information on the cost of cyberattacks, the CSIA said. In addition to a comprehensive data protection bill, CSIA called for the U.S. government to strengthen the power of agency chief information officers and called on agencies to increase testing of cybersecurity controls.
438073
Tens of thousands of U.S. consumers  face a greater risk of identity theft after criminals gained  access to a database of personal records compiled by  ChoicePoint Inc., a company spokesman said on Tuesday.
469624
A year after the U.S. Department of Veterans Affairs disclosed a huge data breach involving the theft of personal information on 26.5 million vets and active-duty military personnel, federal agencies have moved to prevent such a breach from happening again. Here are five steps taken along the way.
80556
GNUCitizen is describing an apparent vulnerability that could trick people into revealing personal data.
738185
Personal information on more than 5,700 current and former faculty members at the University of Virginia may have been stolen by hackers who accessed the data multiple times over a period of almost two years.
649714
The number of e-mail worms fell sharply in 2007, security vendors say.
163052
Robert Vamosi talks with data loss expert Dan Geer about identity theft.
164007
(InfoWorld) - Experts gathered for the ongoing InfoWorld Enterprise Data Protection Forum in New York today said that companies need to get a better handle on all the factors that make their sensitive information susceptible to attack and become more proactive with their overall defensive strategies if they are to improve on their current security status. In a panel presentation featuring leading security executives and consultants, experts highlighted a need for businesses to study all the elements that contribute to classifying their most valuable information as truly sensitive. Protecting records whose value is immediately apparent -- such as social security and credit card numbers -- isn't enough as companies must also shroud any related data that can be used to create an individual profile that could be used to carry out identity theft or other forms of fraud, the speakers said. By defending all the contextual data that can be used to create such a picture, enterprises can greatly reduce their risk and move beyond more obvious strategizing, said C. Warren Axelrod, chief privacy officer at financial services giant U.S. Trust. "What's interesting in financial services is that it is the combination of data that becomes valuable information when it comes together to create an identity," Axelrod said. "If you are just going to file away social security numbers with no way to tie them to identity, they're actually pretty innocuous; but even if you just have a way to associate that information to a phone number or other data, someone can put things together." Axelrod said for the record that "data protection is a contradiction in terms," and that the process will never be perfected, based on the nature of IT systems and the need for businesses to easy retain access to important information.Â  The only way to effectively improve data security is to create a governance hierarchy that allows IT workers to better classify all types of information and to elevate protection of anything that can be used to create an individual portrait, he said. IT consultants agreed, saying that they are advising their customers to use contextual data to help carry out their regulatory compliance projects with greater efficacy. "It's the context that data is used in that qualifies it for regulatory oversight," said Peter Robinson, senior manager for financial services information security at BearingPoint. "You have to protect both the data and all this other information." Perhaps the biggest challenge facing enterprises today in improving their overall data security strategy is becoming more proactive about trying to expect attempted misuse or theft of information, and putting more intelligent tools in place to defend themselves before those situations arise, said Pamela Fusco, chief security strategist at consultancy FishNet. Fusco, who chaired the panel, is also a former chief security officer at financial services bellwether Citigroup. "We don't write a law unless something happens first, as with seat belt laws. We write regulations because something happens, but those are reactive," Fusco said. "Most consultants feel as if we're in reactive versus proactive mode for data protection and integrity." Regulations like the Sarbanes-Oxley Act have proven less effective than legislators might have initially hoped they would be at improving overall data security because businesses have focused on meeting the terms of the guidelines versus boosting their overarching protection schemes, Fusco and other panelists agreed. However, some industry-driven security requirements, such as the PCI (payment card industry) standard forwarded by credit card issuers, have had the desired effect, experts said. Well-written guidelines can help make the difficult task of convincing senior executives to increase their IT security budgets easier, alleviating one of the most significant challenges of the entire data protection process, according to Steve Peltzman, chief information officer at the Museum of Modern Art in New York. "We had to spend a lot of time and money on [PCI], but now I'm thankful for it because I don't have to go through the same routine of convincing everyone that this effort is important," Peltzman said. "The credit card companies got together and made it more expensive for us not to deal with [data protection], which is a good example of industry coming together to create a standard that's actually good." In a seemingly-rare occurrence, the security experts agreed that the creation of an additional, worldwide data protection standard -- as proposed to the assembled group by FishNet's Fusco -- could prove useful in furthering their efforts to secure attention and funding for their data protection strategies. For global companies in particular, establishing such a global guideline could be effective, they said. "The international difference in data protection priorities is an issue. If it could be resolved to where we could get universal classification and more people building innovative solutions, that could be a big benefit," said Erich Mueller, security analyst for Allstate Insurance. BearingPoint's Robinson agreed that such a standard could provide much needed support for security pros. "Anything that can advance the understanding and foster the culture of security in the executive suite is a positive. We've all been trying to do things like this for ourselves for years," Robinson said. "A standard that can help shorten the education cycle and get us where we need to be is something that I would support."
569822
The government agency says four of five incidents involved members of staff accessing databases for unauthorized purposes.
343394
Identity thieves can snare Social Security numbers from a potpourri of public records, especially those maintained by state and local governments, according to a new report by the Government Accountability Office.