Risk Based Security and the Open Security Foundation have conducted a study on 2,164 data loss incidents reported in 2013 producing an interesting report that could help us to better understand the causes and the dynamics for occurred data breaches. The first data that catches the eye is that the majority of that data breached involved outside attackers (72%) meanwhile the insiders are responsible only for 25 percent of the incidents mainly caused by accidents and human error.
“Fraud/Social Engineering is overwhelmingly the mode of choice for inside malicious actor.”
The number of data loss incidents observed in 2013 is increased in an impressive way it’s, in fact, three times bigger than the number of data breaches in 2012, the number of records exposed in 2013 data breaches has reached 823 million.
As expected businesses are the primary victims of the incidents, followed by government, medical and educational institutions, 45.5% of the data breaches hit entities based in the US.
Alarming also the second place occupied by South Korea in which data loss incidents caused the exposure of 140 million email addresses and identification numbers, security experts are confident that were compromised by North Korean cyber units that are very active against South Korea government and national businesses.
US organizations accounted for 66.5% of the compromised records, a deeper look within the US states reveals that the ranking is led by the California which accounted for 370 million records exposed.
A cyber attack exploited the Adobe company drives the “Top 10 Incidents All Time“, the hack of company systems exposed customer names, IDs, encrypted passwords and debit/credit card numbers with expiration dates, source code and other information relating to customer orders 152 Million Adobe Systems.
“Hacking stands out as a leading breach type in the multiple incident dataset.”
The number of exposed records for the attacks occurred in 2013 is very high because many massive data breaches occurred, 51.1% of incidents exposed between 1 and 1,000 records and the number of exposed records was reported as “Unknown” in 26.4% of the 2013 incidents.
260 of the data breaches disclosed in 2013 were a direct consequence of previous incidents which impacted the organization, and sixty organizations reported multiple incidents during 2013.
Following the key findings from the report:
(Security Affairs – Data breaches 2013, security)