Complain about a product or service

Data Breaches: Bad Or Not So Bad?

Studies Offer Conflicting Assessments

By Martin H. Bosworth
ConsumerAffairs.com

September 16, 2006

Data Theft • T-Mobile: No Hacking in Data Breach • T-Mobile Confirms Data Breach • Consumers Increasingly Concerned About Online Transactions • Are Identity Theft Services Worth the Cost? • Online Tools Help Spot Financial Fraud • Financial Fraud Hits 7.5 Percent Of Americans In 2008 • Feds Charge Mortgage Broker In Potential Data Breach • Millions of Credit Cards Exposed in Data Breach • 2008 Data Breach Total Soars • Bank Data Breach Threatens 248,000 in North Carolina • GPS Not Foolproof • Countrywide Warns Millions of Data Breach • Thieves Steal AT&T Laptop with Employee Data • Report: Data Breach Disclosure Laws Don't Affect Identity Theft • Patient Information Exposed in Data Breach at Walter Reed • Supermarket Chain Reports Data Breach • Report: Feds Still Not Doing Enough To Secure Data • Data Thieves Hit Georgetown University Students, Faculty • 800,000 Job Seekers At Risk In Gap Data Breach • TJX Data Breach Settlement Has Strings Attached • More ...

It's a truism that for every opinion, there's a study or paper somewhere that backs it. So it is with data breaches and identity theft.

One new study recently released claims that data breaches shouldn't always be reported if they aren't dangerous, while another claims that many dangerous data breaches go unreported because businesses don't have the resources or means to successfully identify them all.

The Javelin Research & Strategy group released a study on Sept. 15th that found data breaches were responsible for 6 percent of actual cases of identity theft, whereas cases of physical theft accounted for 30 percent of reported instances of fraud. The report was based on a yearlong survey of 5,000 consumers.

The Javelin report echoes findings by other research firms such as Gartner and ID Analytics, all of which have claimed that risk of identity theft from online hacks or security leaks is less than from criminals dumpster-diving for shredded credit card offers.

ID Analytics claimed last year that data thieves tended to focus on small breaches, and notifying every customer of potential data leaks was costly and time-consuming for businesses.

Javelin's findings were similar, claiming that regular notifications of data breaches for consumers were "distracting" and would cause unnecessary difficulties for business. The firm advocated setting up uniform national standards for data breach notifications, a stance that irked consumer groups and privacy advocates.

Supporters of regular data breach notifications pointed to new laws being debated in Congress as examples of potentially dangerous federal laws regarding data theft.

One bill, H.R. 3997, was dubbed "the worst data bill ever" for its provisions that preempt state data breach laws in favor of weaker federal laws, and its enabling companies to withhold notifying customers of data breaches until "reasonable" steps are taken.

The bill also prevents consumers putting "freezes" on their credit reports unless they were already victims of identity theft, a move criticized as favoring the credit industry and denying consumers the right to protect themselves.

Many states have passed laws enabling consumers to freeze their credit regardless of potential identity theft risks. Those laws would be pre-empted if H.R. 3997 becomes law.

The bill's sponsor, Rep. Steve LaTourette (R-LA), is rumored to be reconsidering the bill's credit theft provision.

Lack Of Resources

Another study commissioned by the Ponemon Institute found an excessive number of data breaches at corporations are committed by "insiders," such as disgruntled employees or contractors. The breaches allegedly go unreported due to internal politics or lack of resources to track and prevent them.

The Ponemon survey quizzed over 450 U.S. information technology professionals as to the causes of data breaches at their companies. 78 percent reported an insider-related data breach had occurred on the job, while 93 percent of respondents cited lack of resources as the primary cause of security breaches.

Data security measures and proactive protection were considered low-priority by management, according to the survey. 89 percent of the workers surveyed felt that insider data threats were a serious concern, but only 43 percent felt their CEOs took the concern seriously.

The survey found that the annual cost of insider-related data breaches topped $3.4 million, but that the resources committed to prevent insider hacks were not sufficient. Larry Ponemon, chairman of the Ponemon Institute, said that most data breaches were caused by careless employees, rather than through malice, and often were covered up to avoid embarrassment.

"[M]aybe they are more likely to go unreported because people know each other, and maybe because people know each other, they say it was a mistake and maybe in the future they'll fix it," he said.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |