According to a new data breach report published by Risk Based Security, more than 1.1 billion records have been exposed or stolen in the first 6 months of 2016. Those figures make 2016 the worst ever year for data breaches by some distance and the year is far from over yet.
The good news, if you can call it that, is compared to the first 6 months of 2015, data breaches are down by 17%. Unfortunately, cyberattacks on organizations are exposing more records.
Attacks on healthcare providers and insurers have not been of the scale of those discovered in 2015, although major breaches have occurred. A hacker/hacking group operating under the name The Dark Overlord stole the healthcare records of more than 10 million Americans and listed those data for sale on the darknet marketplace, TheRealDeal. Earlier this year, a hack of 21st Century Oncology exposed the records of 2.2 million patients.
Attacks on web platforms have been discovered in 2016 that have exposed many millions of records. Major data breaches have been discovered to have occurred at MySpace, Tumblr, iMesh, and LinkedIn. The breach at LinkedIn resulted in the theft of more than 100 million login credentials.
In 2016, hackers have exploited vulnerabilities to gain access to huge volumes of data. A misconfigured AWS-hosted MongoDB resulted in the voter details of 93.4 million Mexicans being stolen. Data services company L2 reported that one of its clients discovered that a Couch database had been left exposed, resulting in the exposure of 154 million records.
Phishing and business email compromise scams have also increased in 2016. More than 150 organizations in the United States have reported instances of employees sending data to their attackers voluntarily after being tricked into believing requests for data came from within their company. These attacks resulted in employee W2 data being sent to attackers. Those data have been used to file fraudulent tax returns in the names of the victims.
Even though the data security risk of password reuse across multiple platforms has been widely publicized in recent months, passwords are still being shared and major breaches have occurred as a result. GoToMyPC and TeamViewer reported breaches as a result of password reuse. The passwords were stolen in breaches at other organizations.
Then there is the rise in use of Ransomware. Ransomware has been around for many years, although it has not been popular with cybercriminals. That has certainly now changed. Ransomware is seen as a quick way of making money, and so far in 2016, the malicious file-encrypting software has been used to attack a wide range of organisations around the globe.
The majority of data breaches reported in 2016 have occurred as a result of human error. Databases have been left unprotected, security vulnerabilities have not been identified, employees have failed to identify BEC attacks or phishing emails, and unencrypted devices still continue to be lost and stolen.
Conducting thorough – and regular – risk assessments and plugging security gaps promptly can help to prevent data breaches. Good patch management can prevent many cyberattacks, and conducting employee security training is essential.
Considering the amount of data that can be exposed as a result of misconfigured firewalls, organizations must make sure that settings are checked after upgrades and maintenance is conducted.
It is not possible to prevent all data breaches from occurring, but it is possible to make it harder for cybercriminals to obtain data. 2016 is already the worst ever year for data breaches, but unless action is taken it could get a whole lot worse.