U.S. identity theft losses fall: study
196938
Americans lost about $49.3 billion in 2006 to criminals who stole their identities, an 11.5 percent decline that may reflect increased vigilance among consumers and businesses, a study released on Thursday shows.
336942
Thousands of Wells Fargo mortgage and student-loan customers may be at risk for identity theft after four computers were stolen last month from a vendor that prints loan statements.
284321
Hacking tools nick nicked data Many of the people behind identity theft scams are themselves having data stolen from them in the process, a security researcher has revealed.â¦
571540
The Identity Theft Enforcement and Restitution Act would provide protection for consumers who fall victim to identity theft.
367998
(InfoWorld) - Most large data breaches don't appear to lead to identity theft, and proposals that would require companies to notify customers of most breaches may lead to increased costs without significant benefits, says a report from a U.S. government agency released Thursday. The report, from the U.S. Government Accountability Office (GAO), said only four of the 24 largest data breaches between January 2000 and June 2005 appear to have resulted in identity fraud. Wide-ranging data breach notification laws that would require nearly all breaches to be reported could lead to notifications that "present little or no risk, perhaps leading consumers to disregard notices altogether," the report said. While a breach notification law would have several benefits, a law that requires notification for nearly all breaches could also create significant costs for businesses, the report added. The U.S. Congress is currently considering several breach notification bills, including some that would require notification for nearly all breaches. Instead, Congress may want to consider a notification rule based on the potential for the risk of ID theft, the report said. The U.S. President's Identity Theft Task Force has recommended a national standard for determining when government agencies and private companies should report breaches, the report pointed out. A risk-based standard "could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk," the report said. A data breach law would create costs for businesses, including the cost of developing incident response plans and notifying customers, the report said. While it's difficult to determine costs, a Ponemon Institute study in 2006 found that 31 companies with breaches incurred an average cost of $1.4 million per breach for notifying customers, staffing call centers, paying legal fees, and other expenses, the report said. The GAO researched 24 large data breaches reported in the media between 2000 and 2005, and found that 18 of them had no ID theft or fraud identified. Three of the breaches, at CardSystems Solutions, DSW, and CD Universe, had reports of fraud associated with existing customer accounts. And a breach at ChoicePoint had reports of unauthorized new accounts opened. In the remaining two breaches, GAO was unable to determine if there had been ID fraud. It's difficult to track ID theft resulting from data breaches, the report said. In some cases, thieves don't attempt to use the data until a year or more after the breach, the report said. A breach notification law could be beneficial because it would encourage organizations to improve data security, the report said. "Care is needed in defining appropriate criteria for data breaches that merit notification," the report said. "Because breaches vary in the risk they present, and because most breaches have not resulted in detected incidents of identity theft, a notification that is risk based appears appropriate." Alan Paller, director of research at the SANS Institute, a security research and training company in Maryland, praised the report, saying some in Congress have focused too much on data breaches. Some lawmakers have "dropped the ball on the far more important area of attack-based defenses," he said. The report is important because it gives Congress more information about data breaches, added Thomas Lenard, senior fellow and acting president at the Progress and Freedom Foundation, a conservative think tank. "Itâs very good to have more data on this issue," he said. "[The report] reinforces my view that we should only adopt new regulations in this area if it can be shown that their benefits are greater than their costs."
392248
LOS ANGELES - California university officials have warned nearly 600,000 students and faculty that they might be exposed to identity theft following incidents where computer hard drives loaded with their private information were lost or hacked into.
505541
InfoWorld - Identity theft remained top of mind among U.S. consumers last year, but complaints about Internet auction fraud dropped noticeably, according to data released Wednesday by the U.S. Federal Trade Commission (FTC).
612184
The theft of a laptop containing Social Security numbers of Nashville, Tennessee, area voters is expected to cost local officials about US$1 million as they roll out identity-theft protection to those affected.
246050
Weeks after the government admitted that it had lost computer discs containing the names and bank account details of 25 million people, exposing nearly half the population to possible fraud and identity theft, the U.K. said a contractor has lost personal data on 3 million learner drivers.
342071
Internet identity theft is one of the fastest-growing crimes in the U.S. today. For five straight years, the Federal Trade Commission (FTC) ranked it as one of the most-reported types of fraud. Despite the increasing awareness of identity theft among consumers and financial institutions, the identity-theft racket shows no signs of slowing. Reported losses from identity theft, currently responsible for over 40 percent of all fraud complaints, approached nearly $300 million last year.
560635
InfoWorld - The theft of a laptop containing Social Security numbers of Nashville, Tenn.-area voters is expected to cost local officials about $1 million as they roll out identity-theft protection to those affected.
111329
A report released Thursday by the GAO indicates that just one-sixth of the 24 largest data breaches reported between January 2000 and June 2005 resulted in actual identity theft. The report could give support to those who want breach-notification rules eased.
594426
Network attacks using stolen IDs result in substantial damages, according to an analysis of federally prosecuted cases.
698101
SAN JOSE, Calif. -- Consumers are bombarded with warnings about identity theft. Publicized threats range from mailbox thieves and lost laptops to the higher-tech methods of e-mail scams and corporate data invasions.
438947
Despite growing fears about online fraud, a new study finds that most cases of identity theft originate offline.
610632
(InfoWorld) - Despite widespread media coverage of data breaches over the past year, identity fraud is actually dropping in the U.S., Javelin Strategy & Research Inc. reported Thursday. In fact, the cost of identity fraud was down 12 percent from Javelin's 2006 survey, at an estimated US$49.3 billion in losses. The number one source of ID fraud? A lost or stolen credit card. "ID fraud is down," said James VanDyke, Javelin's president and founder. "It hasn't been growing for several years, but we hadn't seen it drop." Nationwide, there were about 500,000 fewer victims, according to this year's survey, VanDyke said. Much of the drop can be attributed to improved antifraud practices on the part of consumers and businesses, he said. "Businesses are doing a better job of not granting new accounts [to criminals]," he said. And consumers are also monitoring their account activity more closely and reporting suspicious transactions to the banks much more quickly. Javelin based its findings on 5,000 telephone interviews with U.S residents conducted over three weeks last October. The survey follows a methodology established by the U.S. Federal Trade Commission, which released a similar study back in 2003. The Javelin research was sponsored by CheckFree Corp., Visa USA Inc. and Wells Fargo & Co. The survey's findings are at odds with those of research firm Gartner Inc., which has reported that ID theft is on the rise. But VanDyke says that this is because Javelin's numbers include responses from a wider range of people, including those who lack Internet access. "Thirty percent of people in the U.S. are not on the Internet, and those people have a vastly different way of managing their finances," he said. According to Javelin, there are also important differences between the way rich and poor people react to ID theft, something that VanDyke describes as a "fraud detection digital divide." "The low-income people essentially run away from purchases and they run away from the Internet," Van Dyke said. Affluent people, on the other hand, tend to embrace the Internet as a way to avoid having sensitive data stolen from the mail, and to keep tabs on their account activity, he said. Mail theft accounted for about 9 percent of all ID compromises. That's more victims than data breaches and phishing combined, according to Javelin's numbers. Javelin also found that young adults between the ages of 18 and 24 were at greater risk of ID theft, with more than 5 percent of respondents having been victimized. "They're being haphazard and as a result, they're being victimized," VanDyke said. "They're not protecting their PCs with antivirus software and firewalls.
434215
(InfoWorld) - Contrary to popular perception, computer data breaches are less likely to result in identity theft and other fraud than off-line causes such as lost or stolen wallets and checkbooks. That was the finding of a year-long study of about 5,000 U.S. consumers by Pleasanton, Calif.-based analyst firm Javelin Strategy & Research. Javelin's research showed that despite recent hype, data breaches were responsible for just 6 percent of all known cases of identity theft, compared to 30 percent from incidents like losing one's wallet. The study also showed that less than 1 percent of all individuals whose data was lost later became victims of ID theft. Javelin's results are similar to those found by other firms that have looked at the relationship between data breaches and actual instances of ID fraud. In a Gartner study in 2005, for instance, only 18 percent of identity theft victims attributed the cause to computer breaches, while 41 percent cited off-line causes. Similarly, a December 2005 analysis by ID Analytics Inc. of four major online data breaches involving 500,000 customer records showed that less than 1 percent of those affected had their identities stolen. The numbers are important at a time when a spate of data breach disclosures has heightened consumer concerns and is fueling a debate among lawmakers about the need for more stringent data protection laws, analysts said. "There is a misperception that there is a one-to-one correlation between a data breach and ID theft," said Thomas Oscherwitz, vice president of government affairs and chief privacy officer at San Diego-based ID Analytics. In reality, "the mere fact that you are part of a data breach doesn't mean that you are a victim of ID theft," he said. The degree of risk can depend on the type of breach, Oscherwitz said. Data breaches involving a deliberate hacking, for instance, are likely to be much more risky than those involving a lost disk or laptop, he said. Failing to make such distinctions can push consumers to undertake unnecessary efforts to protect themselves and can impose burdens on corporations, said Mary Monahan, author of the Javelin study. "Our opinion is that consumers do need to be protected by data breach laws, and we do want to see a federal law to protect all consumers," Monahan said. But given the low risk of ID theft from such breaches, any such law would need to give the breached entity the opportunity to conduct a risk assessment before they are required to disclose it publicly; The absence of such a trigger could result in indiscriminate notifications. "And then all you get is white noise" that few people pay attention to, Monahan said. Currently, many of the 30-plus states that have breach disclosure laws require companies to notify customers of any data breach involving the potential compromise of personally identifiable information. Several industry groups have been lobbying lawmakers for a preemptive federal law that would add some sort of a breach notification trigger that is based on an assessment of the risk of ID theft or other fraud. Privacy advocates, on the other hand, have been arguing for broad disclosure, saying that few companies are likely to publicly notify consumers of a breach if they are allowed to make their own risk assessments. "I think it's always going to be difficult to make a conclusive cause-and-effect relationship between ID theft and data breaches," said Andrew Jacquith, an analyst at Yankee Group Research Inc. in Boston. So the real emphasis of any national legislation has to be on measures that companies need to take to protect sensitive customer data, he said. Also important is the need to examine issues like the continuing use of Social Security numbers as identifiers by a large number of companies, Jacquith said. "I view nonpublic information as radioactive material that needs to be protected [from leaks]," he said. "It's material that you can use to manufacture identities with."