Forget hackers; companies responsible for most data breaches, study says

[Brooke_NY]

March 14, 2007  (Computerworld) -- In the five minutes it might take to read this article, about 672 electronic records containing confidential information will be compromised. By year's end, more than 72 million records with Social Security numbers, credit card numbers, birth dates and other personal data will have been exposed. That rate is about 200,000 more records per month than last year.

And the main culprit is not the oft-vilified rogue hacker, but corporate America, according to a new study by the University of Washington, Seattle.

That conclusion is based on a review of 550 security breaches reported in major U.S. news media outlets from 1980 to 2006. The goal of the study was to examine the role of organizational behavior in privacy violations. It showed that internal foul-ups such as putting personally identifiable information accidentally online, missing equipment, lost backup tapes or other administrative errors were responsible for 61% of the incidents.

In contrast, just 31% of the incidents were perpetrated by external hackers; 9% had unspecified causes.

"What this shows is that a surprising number of incidents actually involve corporate mismanagement more than hackers," said Philip Howard, assistant professor of communication at the University of Washington and co-author of the report. "I think it is easier when your company loses a lot of client data to put an immediate spin on it and blame it on a hacker or some external guy using some ingenious hacking technique."

The reality, though, is that in more cases than not, internal errors caused the data breach, he said.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9013142&source=NLT_SEC&nlid=38

[Cameron]

My IT Teacher at school was telling me about how his insurance company was retarded and kept the backups for the company in his car for some stupid reason and the car was stolen, with over 100,000 customers' personal information compromised. So he gets free insurance for like... 2 years now, or something. HUGE hit for the business. Losing millions. I'm surprised they're still in business...