TrendMicro debunks myths around data breaches
Hacking and malware are always blamed for being the biggest issues behind data breaches, but according to TrendMicro's latest analysis of the years of data, they are only the second biggest cause accounting for 25% of data breaches: 42% are caused by "device loss" (or theft). The retail sector is typically held up as being the riskiest area for data breaches: not true, it comes fourth in line after healthcare, education and government. As for your personal identification information (PII), apparently there is such a surplus of PII available in the underground market that the price has collapsed from $4 per PII to just $1 in the past year.

These past 10 years have given us some of US history's most high-profile data breaches. There was the AOL incident in 2005, where an insider leaked sensitive data. The Sony (2011) and Target (2014) incidents exposed millions of customer records. And this year alone, we saw healthcare companies (Anthem), government agencies (OPM), and even online dating services (Ashley Madison) get hit with breaches of their own. The magnitude of stolen information is staggering, and the variety of which even more so. Much of the attention surrounding these breaches has been focused on who's affected and how they can recover. The stolen data on the other hand is treated as a lost cause. But there is so much more to learn from studying what was stolen. By following the data, we can get a picture of what attackers are looking for, how they use the data, how much it costs, and where it eventually ends up. Numaan Huq of the Trend Micro Forward-Looking Threat Research team analyzed a decade's worth of data breach information to gain insight into the odds at play when a company suffers a breach. His probability studies will allow companies to assess their current risk levels in order to come up with better strategies to defend their networks. They also help us prove if what we know about data breaches have merit or are just mere myths.

Myth # 1: Hacking and malware are the leading causes of data breaches. Although the news has been rife with stories of how certain malware or hacking groups were responsible for breaches, the truth is, most of them were actually caused by device loss. Overall, it accounts for 41% of all breaches compared to the 25% caused by hacking and malware. Companies may often overlook the kind of sensitive information stored on their employees' laptops, mobile devices, and even thumb drives. If any of these devices get lost, stolen, and are left unprotected, they become an easy way to steal data. This doesn't mean, though, that hacking and malware are not serious. These kinds of threats should never be taken lightly. Compared to device loss or theft—which can be mitigated through remote device wipe, the use of virtual infrastructure, and enforcement of stricter policies—hacking and attacks using malware are more planned and deliberate. Highly customized defense solutions and strategies are required in these cases. Circle Hover over the icons to see what methods caused the most number of breaches from January 2005- April 2015 Probability of using different breach methods

Myth # 2: Attackers go for personally identifiable information (PII) to reap the most data. This is both true and false. Although PII is the most popular stolen record type, it doesn't guarantee an attacker more access to his target information. It really depends on the situation and the attacker's goal. If the aim is to get educational or health records, having a person's PII will give the attacker a higher chance of accessing those bits of information. If attackers really want to gain access to the proverbial keys to the kingdom, they would go for credentials, more specifically, the credentials of a network administrator. 0 Click on a stolen record type to see the odds of other record types getting compromised. 0 Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Financial 21.8% 11.3% 28.65% 19.74% 2.15% 34.03% Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Others 1.5% 1.56% 1.75% 2.15% 2.06% 0.82% Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Health 7.42% 23.37% 4.11% 22.27% 22.27% 4.62% Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. PII 7.05% 79.14% 43.68% 50.42% 72.04% 73.33% Sorry, your browser does not support inline SVG. Education 4.84% 6.47% 1.35% 4.62% 3.11% 1.17% Payment card 16.68% 7.6% 2.87% 2.23% 15.72% 4.62% Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Sorry, your browser does not support inline SVG. Credentials 10.93% 9.23% 14.96% 7.56% 3.6% 17.86%



Reload Conditional probability of Record_Type_Y also getting stolen if Record_Type_X is

Myth # 3: Using hacking or malware is the best way to steal all types of data. Looking at the probability, this one is actually true, only because these were the most popular methods attackers used this past decade. Hacking into a network—whether using brute force, social engineering, or malware—has the highest chance of returns. The second most preferred method is through insiders. These can be disgruntled employees who leak the data on their own volition. 0 Click on any of the icons to see what kinds of record types can be stolen using the different breach methods. Phishing

Phishing

Vulnerability

Server

Database

Hacker

Server

Credit card

Debit card Hacking or malware Fraudulent purchases

Retailer

Restaurant

Skimming device

Credit card

Debit card Payment card fraud Posted

online

online Records exposed

Contractor

Accident or mistake

Third-party vendor Unintended disclosure Fraud tax claims

Identity theft

Records stolen

Records misused

Records sold

Dishonest employee Insider leak Portable devices Hard drive Encrypted Flash drive Unencryp-

ted

Physical records Improper disposal Hospital or clinic

Devices Equipment Computer

Loss or theft Unauthorized access Unknown Sorry, your browser does not support inline SVG. PII Financial Health Payment card Credentials Education Others Unknown



Reload Commonly observed data breach scenarios

Myth # 4: The retail industry is the most affected by data breaches. Although retailers have suffered many losses because of data breaches, the most affected industry was actually the healthcare sector, accounting for more than a fourth of all breaches (26.9%) this past decade. The second was the education sector (16.8%) followed by government agencies (15.9%). Retailers only come in fourth place with 12.5%. Although its share is not as big as the healthcare industry's, the effects of a breach for a high-profile retail giant can still be damaging in terms of reputation and revenue. Industries affected by data breach