As regular readers of this blog already know, the ICO has issued fines over data protection breaches precisely four times since he acquired the authority to do so, despite public clamor for him to really get tough. Now Caroline Donnelly reports: … In total, information concerning 2,565 potential data breaches was passed on to the…
Category: Commentaries and Analyses
Verizon-USSS 2011 data breach investigations report released – what do they know that we don’t?
The annual report based on breaches investigated by Verizon and the U.S. Secret Service is out. On first reading of the report and the available media coverage, the big headline seems to be that while the number of records or data lost is down significantly, the number of breaches is significantly up – and more…
Hundreds of College and Government websites still redirecting to fake stores
In January, I talked about high-profile websites, which had been hacked to redirect users to fake online stores. One unique aspect of the hack was the fact that the attackers had set up additional web servers on non-standard ports. Most of the domains I listed in the post were cleaned up pretty quickly. Three months…
Aussie data breaches doubled in 2011
Darren Pauli reports: The number of Australian data breaches reported to forensic investigators has already doubled those experienced in 2010, even though it’s only April. Some of the worst breaches have cost businesses many hundreds of thousands of dollars, and involved significant loss of credit card information and customer information. Yet it seems that none…
Data breach notification fatigue: Do consumers (eventually) tune out?
George V. Hulme writes: Earlier this month more than 50 companies were involved in a massive heist of names and email addresses from Epsilon Interactive. With millions of customers of companies such as Best Buy, Brookestone, Dell, Marriott and many others affected, the question is being raised: are so many breach notifications from so many…
The Epsilon Hack Attack: Time For “SOX For Consumers”?
Matt Pauker of Voltage Security discusses the Epsilon breach and where we go from here. He writes, in part: What about requiring every third-party service provider to protect personal customer data through encryption, tokenization or another advanced security technology, through clauses written into and enforced as part of standard service level agreements? This is something…