Types of Data Breaches

Malicious software, also known as malware, spyware, a Trojan horse attack, worm or virus, is digital code installed on your laptop, smartphone or other device. As the Federal Trade Commision explains in its Consumer Advice, malware can get installed if you click on or download a scammer’s email attachment, fake ad or security pop up. It can also happen when illegally downloading free movies or video games.

Once installed on your device, hackers have access to your digital activity and personal information. One of the biggest data breaches in history was the Notpetya breach in which the Russian army is believed to have used malware to cause the Ukraine electrical grid to fail in 2017. The breach cost shipping giant Maersk $300 million in damage and global damage was estimated at $10 billion.

The Cybersecurity and Infrastructure Security Agency, known as America’s Cyber Defense Agency, recommends organizations educate and train staff on preventing malware breaches. Operating systems and data should be regularly backed up, networks should be separate and critical operations should be kept on a closed network. CISA announced the creation of a Ransomware Vulnerability Warning Pilot in 2022 to proactively identify information systems relating to critical infrastructure entities that contain vulnerabilities.

Phishing breaches happen when hackers present themselves as someone you know or an organization you trust. A spoofing attack is one form of phishing in which cyber attackers use familiar email addresses or URLs, changing a letter or number within the name, but keeping it similar enough to appear to be a trustworthy source. These phishing attacks can act as a vehicle for installing malware.

Once people click on links or attachments in a phishing message, their computers and sometimes broader networks can be infected. Also one of the biggest data breaches in history, the North Korean phishing attack of Sony Pictures used emails that appeared to be from Apple. Sensitive emails and records were accessed and the incident cost Sony $100 million.

The CISA identified a phishing breach in which the Small Business Administration COVID-19 loan relief webpage was spoofed. Swedish bank Nordea was spoofed in an email sent to clients that was infected with a virus. People who opened the email were directed to a false home page and asked to enter login information. Believed to be a Russian attack, the phishing incident enabled the theft of $1 million.

CISA advises people to avoid opening generic-looking email greetings and clicking on suspect links. If you hover over links instead of clicking, you can better verify their authenticity. Change your password frequently.

Employees or organization members with authorized access are responsible for insider breaches. Insider breaches can be accidental, but the threat can also be planned as part of external coordinated theft, espionage or terrorism. Using access badges, network access, knowledge of the structure or strategies of an organization, insiders can gain trade secrets, personnel data or financial information.

Financial institutions and cryptocurrency organizations have been vulnerable to intentional threats from state actors such as North Korea, incurring high costs. An example of an accidental insider breach involved a healthcare provider disclosing protected health information of its patients to unauthorized third parties because of a pixel-related data breach.

The United States Attorney’s Office reported a deliberate insider breach at General Electric that led to a former engineer being convicted of conspiracy to steal trade secrets and sentenced to two years in prison. The engineer worked with a co-conspirator from 2008 through 2019 to use employee access to confidential information to compete with GE globally.

A joint Stanford University and security firm study found that employee mistakes cause 88% of data breaches. IBM research indicates that human errors, including negligent actions of employees or contractors, were responsible for 21% of breaches. 

While companies can be quick to blame individual employees for data breaches, experts identify lack of proper security measures and poor training as key vulnerabilities making human error breaches possible.

When credit-rating company Equifax experienced a data breach in 2017, an IT technician was blamed. The company said the tech failed to communicate key information about patching an application, compromising the data of 145 million people. However, Equifax agreed to settle with the Federal Trade Commission, the Consumer Financial Protection Bureau and 50 U.S. states and territories for $575 – $700 million for failing to take reasonable security steps.

No matter the type of data breach, the costs can be serious, so a growing number of organizations are adopting a “zero trust” approach to protect themselves against data breaches. This “trust no one and nothing” point of view in action requires everything and everyone trying to gain access to the network be verified.

Several data breach lawsuits have been filed seeking compensation for loss of privacy and important data as a result of data breaches. Plaintiffs claim losses were sustained when their personal information was stolen and leveraged.