By Thomas Claburn
January 3, 2008
The year 2007 may or may not have been a record-setting year in terms of
data breaches. Whether it was or wasn't depends on how one counts.
The Identity Theft Resource Center put the number of publicly reported
data breaches in the United States at 446 for the year. It identified
312 data breaches in 2006 and 158 in 2005.
That appears to show an upward trend, if such a thing can hinge on a
mere three data points, and that more data breaches occurred in 2007
than at any time since 2003, when data breach reporting laws like
California's SB 1386 took effect.
But a blogger who insists on going by the name Dissent and maintains a
blog that tracks data breaches insists the opposite is true.
Based on his or her analysis of data breach statistics compiled by three
sources -- Attrition.org, Privacy Rights Clearinghouse, and the Identity
Theft Resource Center -- Dissent points out inconsistencies in counting
methodologies and argues that without the TJX breach (parent company to
T.J. Maxx and others), which skews the statistics by virtue of its
extreme size, two of the three sources show a decrease in data breach
incidents and in records exposed.
Rex Davis, director of operations for the Identity Theft Resource
Center, concedes Dissent makes some valid points, like the fact that the
organization began counting paper-based data breaches in 2007.
But Davis also points out that tabulating the number of records exposed
is difficult because in 56% of the 2007 breaches reported, there was no
accurate count of the number of records exposed. "How can you say the
number of records is going up or down when it's not reported?" he said.
Reasonable people can also disagree about the year in which data
breaches should be counted. Davis said his organization prefers to go by
the date of publication. "We chose the publication date for 2007 rather
than the incident date," he said. "A lot of times we can't even get an
incident data. TJX is great example."
But as Dissent points out, if TJX were counted in the year 2006 or 2005,
2007 would look at lot better.
While Dissent's assessment of data from Attrition.org and Privacy Rights
Clearinghouse suggests a decline in the number of data breach incidents,
the ITRC is sticking with its incident figures. "If you're talking about
the number of events, it's the worst year we've been able to record,
even if you add the 80 we left out in 2006," said Davis.
Visit InfoSec News