Slashdot Mirror
Breaches Exposed 22.8 Million Personal Records of New Yorkers
An anonymous reader writes Attorney General Eric T. Schneiderman issued a new report examining the growing number, complexity, and costs of data breaches in the New York State. The report reveals that the number of reported data security breaches in New York more than tripled between 2006 and 2013. In that same period, 22.8 million personal records of New Yorkers have been exposed in nearly 5,000 data breaches, which have cost the public and private sectors in New York upward of $1.37 billion in 2013. The demand on secondary markets for stolen information remains robust. Freshly acquired stolen credit card numbers can fetch up to $45 per record, while other types of personal information, such as Social Security numbers and online account information, can command even higher prices.
WTF?
Perhaps it's time for companies to realise that they cannot keep data secure. That they will never be able to build, much less be willing to pay for, the security required to keep this information under any kind of seal.
Perhaps it's time for companies to ask themselves: "Do we really need to store this?".
May the Maths Be with you!
Say, full damage caused, including $100 per hour the person affected had to spent clearing this up, with at least 10h assumed and no need to prove anything for them. With that, companies might just start to care about the security of customer data. Currently, they basically have no incentives to spend any money on secure coding, security reviews and the like.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
$1.37 billion / 22.8 million.... wait are they saying my information is worth $60? Woohoo. $60! Now where do I cash out?
And of course, the burden of cleaning up your name is on you.
Businesses and governments who are careless with our data just send out an apology and move along.
It takes a long time to straighten out, but in the meantime, you are harrassed by collectors and sometimes even arrested.
And the expense is yours.
sue? Yeah, good luck with that.
Make debt the responsibility of the lender.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It's actually 'Breeches' and now we finally know Step 2.
Worst. Signature. Ever.
Companies have proved they do not care about your data and are willing to essentially give it away via breaches. And *nothing* is ever done about preventing identity theft, because the burden of fixing it is up to the individual, not the credit card issuer, and not the large faceless corporation that saved $20 on security software, but let the hackers in to take your identity in the first place.
They then promise to fix the problem, but then never do. And government looks the other way because they are in the pocket of big business in the first place.
So, beat them to the punch: Sell your identity to the hackers. Make it a place like ebay where people get to bid on you. You get money (probably from a previously stoeln credit card); the hackers get to perform credit card fraud; and then you get new cards issued from your bank, and a week or two later, you get to start the process all over again. In the meantime, there's an "economy" at work, and believe it or not, it's on the backs of the credit issuers, who have to keep replacing your card.
Then, after a few years of that; they might actually do something about the ease of identity theft.
Sure, you've ruined your credit rating; but in the meantime, so has everyone else -- this only works if everyone does it of course -- so credit ratings become meaningless and the world, like in fight club, becomes a better place and maybe we go back to the days where companies took some responsibility and weren't just gouging everyone for every last cent.
Maybe, just maybe, we can turn this thing around on them and take our planet back.
If telephones are outlawed, then only outlaws will have telephones.
Not exactly impressed with it.
Data security breaches between 2005 and 2009 were recorded in Microsoft Word documents,
while 2010-2014 breaches were recorded using Microsoft Excel Spreadsheets. After the data
were successfully combined into one spreadsheet, a significant amount of “cleaning” was
necessary to correct inconsistencies that prevented accurate analysis.
This process also included standardizing breach events into broader categories for analysis,
since some notice descriptions were often brief and/or ambiguous. Despite best efforts, some
descriptions were simply too ambiguous, and were therefore categorized as “other.” Examples
of these descriptions include other criminal acts (“extortion,”“mail tampering,” and “check
counterfeiting”) and the unexplainable (“files found outdoors” and “student chose user PIN
of another”). Breach events that were recorded without any discernable descriptions were
categorized as “unknown.”
The construction of the “hacking” category included descriptions such as “computer virus”
or “malware,” as well as “unauthorized intrusion” or “unauthorized access.” Based simply on
those descriptions, some of the unauthorized access/intrusion categories could have been
misclassified.
And the dollar amount of the damages come from a study conducted by Symantec and the Ponemon Institute, two vendors of security products and consultation, rather than from an organization with less of a potential for a conflict of interest. Also, the report makes it seems as if New Yorkers in particular are being targeted, but in reality most of the larges breaches listed have to do with retailer like TJ Max, Target, Sony, LivingSocial, etc. which affected customers from all states, not just New York.
Finally, recommendations of the report for increasing data security and protecting privacy are pretty much run of the mill: use encryption where possible, minimize data collection (if you don't need a customer's SS#, DON'T ASK FOR IT), keep software updated, etc. I'm not sure what this report is trying to accomplish, other than exaggerating the the true costs of breaches and over reporting amount of breaches made by hackers (I think insider compromises are harder to detect and more prevalent than reported).
Misread that as "Beaches expose 228 million personnel of New York"
Took me a reread to realize this wasn't some commentary about a nude beach on Fire Island.
isn't time we just ditch the fiction that privacy as we knew it in the 20th century is gone forever and accept that everything we do and say on any digital medium will be collected?
sheesh...yes I get it already...databases compromised, hacked, sold...NSA spying, collecting...
good lord how many times do we need to be wack-a-moled before we just stop caring?
never bring a twinkie to a food fight.
Perhaps it's time for some litigation. These breaches should fall into an area similar to product liability where the cost of shoddy work is expensive.
It little behooves the best of us to comment on the rest of us.
We need a pre-designed single purpose device for sensitive information that's both hardened and designed to be secure from the ground up. There is no good reason it should take a degree in ms in computer science, 10 years on the job experience, a specialization in security, and days worth of effort to put together a reasonably secure web site (and then still not have it be really all that secure). Not to mention maintaining updates for it.
While I feel GNU/Linux distributions have had (to a greater degree) better solutions to this problem (ie security updates for all critical applications, as opposed to having to manually update everything, as is the case in ms windows to a large degree) it's far from perfect. There aren't many distributions (in fact I'd probably argue there aren't any) that are secure from the ground up.
This is another thing we need. Besides a single purpose device to store and limit access to that information (that is you can set limits so that when hacker breaks into the site they can't perform requests to dump the entire database, etc) we need a distribution designed to be secure and still relatively easy to use.
The costs of attempting to BE compliant to these vague horrible laws is far higher than the cost of losing control over something. This is why HIPAA is a huge waste of time and effort. It costs millions to 'comply' with the law but the downside is near zero because, and this is important
YOU HAVE TO PROVE INTENT
So any law is going to be ineffectual on its face when it looks only at intent. And specifically, the intent to profit from it. Target didn't intend to break something. They goofed up. So the law doesn't really cover mistakes. If Target was part of this vast scheme to rob people that's a different matter.
Because giving people that can't be held accountable unfettered access to all of your data and records will lead to LESS identity theft, right? Right????
It's a $1.37 billion dollar boost to the economy! You can't just print money for banksters without spreading it around a little bit!
When the money gets stolen, its insured by the government that just prints some more, and paper grows on trees!
Finally we have found a growth industry with real American entrepreneurship that is compatible with current fiscal policy. We can re-hypothecate futures on funny money stolen by criminals that aren't bank executives! Its a new system of cheques and balances in a brave new kleptocracy!
Eureka!
This year has seen a lot of The US versus John Doe Citizen cases, so I'm wondering if an attorney will actually hold a corporation responsible. I mean, outside of investigations by FDA/ICE/ SEC/FBI and other 3-letter branches of federal government.
In John Does cases, the government can steal their assets, choose their lawyer and lock them in prison. Government thuggery isn't so easy against a corporation.