Incomplete Data Breach Reporting Makes Tracking Hacks Tough, Organization Says

Cyber-security's always a hot topic because people always worry about keeping data safe, but concerned parties may be missing out on the whole story when it comes to how many, or how few, data breaches happen at any given time.

The Identity Theft Resource Center (ITRC), an organization that collects information about data breaches from media sources and government notification lists, publishes data breach reports and researches IT security in public- and private-sector entities. But according to Linda Foley, who founded the center with her husband Jay Foley, it's difficult to provide a clear picture of how secure the cyber-world is because breached organizations aren't upfront enough when they've been breached and how badly.

"Breached entities, No. 1, are afraid of the consequences. They're afraid that their reputation will be damaged, of fines they might incur, of the repercussions of a trust issue," she said.

The ITRC issued a press release on Jan. 8, 2010, titled, Data Breaches: The Insanity Continues, citing the lack of a single data breach list requiring mandatory public reporting. Foley feels that this might change if the law intervened and forced organizations to step up.

"It takes law enforcement response. It takes the response of someone sitting there and saying, 'What are you going to do about it?'" she said.

The ITRC's 2009 Data Breach Report recorded more than 222 million potentially compromised records last year in 498 breaches, but in more than 52 percent of the breaches, the victimized organizations didn't disclose how many records were affected. So that 222 million? That only accounts for the breaches people wanted to talk about in public.

The insanity in this case is how difficult it is to count breaches in these circumstances. But of the data the ITRC has, breaches in the business sector number at 205 of 498 reported breaches in 2009, 41.2 percent. That's a larger concentration than in 2008, when business breaches numbered at 241 of 657 breaches, 36.7 percent. Government and military breaches constituted 90 of 498 breaches in 2009, for 18.1 percent. That's a smaller concentration than the 2008 figure, when that sector had 110 out of 657 for 16.7 percent.

Foley said many of the breaches can be reduced with better encryption and redaction, and she's hopeful that upcoming legislation can make better breach reporting required by law. S. 139, which was introduced by Sen. Dianne Feinstein, D-Calif., would required federal agencies and people involved in interstate commerce to disclose breaches of data containing personally identifiable information. The bill has passed through committee and is on the legislative calendar.