Data Breach Harm Analysis Uncovers New Patterns of Misuse

The results of a new study on the harm resulting from data breaches were announced this week. The study analyzed more than ten million identities spanning over a dozen data breaches. ID Analytics found five separate cases where breached identity data was misused by fraudsters, with two of those cases resulting from employee theft of data.

  Key findings from the research include the following:

• Smaller breaches had a higher misuse rate than larger breaches.  Misuse of personal data ranged from one in 200 identities for breaches of fewer than 5,000 individuals to a misuse rate of less than one in 10,000 identities for breaches of more than 100,000 individuals.
• Fraudsters engaged in organized misuse of breached identity data tended to cycle through the data quickly. Fraudsters would misuse a breached identity for no more than two weeks before moving onto the next identity.
• The study found no evidence that fraudsters misusing breach data were selling the data broadly or distributing it over the Internet.  This finding is significant because one of the greatest potential risks of data breaches is the broad dissemination of personal information to others with criminal intent.
• Fraudsters tended to link the breached personal data to a limited set of new phone numbers or addresses, meaning they worked to associate these identities with particular phone numbers for verification purposes and with addresses where they could receive credit cards, wireless phones or other merchandise ordered using the breached identity data.

"In the two years since we conducted our previous National Data Breach Analysis study, concerns about data breaches have remained high," said Thomas Oscherwitz, ID Analytics' chief privacy officer and vice president of government affairs. "This new research shows the latest trends about the harm resulting from data breaches and how criminals are actually using the data. Our intention is to help organizations understand which types of data breaches pose the greatest risk, and how to best respond."

In two of the five cases of organized misuse, the breach perpetrator was an employee who stole data. In both cases, the resulting misuse was linked to identities geographically close to the site of the employee theft. These findings show new insights into the workings of internal data theft, particularly how fraudsters may favor those identities that represent easier access to physical addresses where the perpetrator could receive or intercept credit cards, stolen goods and bank statements.