Personal Information: Data Breaches Are Frequent, but Evidence of Resulting Identity Theft Is Limited; However, the Full Extent Is Unknown
Published: 2007-06-04T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In recent years, many entities in the private, public, and government sectors have reported the loss or theft of sensitive personal information. These breaches have raised concerns in part because they can result in identity theft--either account fraud (such as misuse of credit card numbers) or unauthorized creation of new accounts (such as opening a credit card in someone else's name). Many states have enacted laws requiring entities that experience breaches to notify affected individuals, and Congress is considering legislation that would establish a national breach notification requirement. GAO was asked to examine (1) the incidence and circumstances of breaches of sensitive personal information; (2) the extent to which such breaches have resulted in identity theft; and (3) the potential benefits, costs, and challenges associated with breach notification requirements. To address these objectives, GAO reviewed available reports on data breaches, analyzed 24 large data breaches, and gathered information from federal and state government agencies, researchers, consumer advocates, and others.
section_title: What GAO Found
paragraphs: While comprehensive data do not exist, available evidence suggests that breaches of sensitive personal information have occurred frequently and under widely varying circumstances. For example, more than 570 data breaches were reported in the news media from January 2005 through December 2006, according to lists maintained by private groups that track reports of breaches. These incidents varied significantly in size and occurred across a wide range of entities, including federal, state, and local government agencies; retailers; financial institutions; colleges and universities; and medical facilities. The extent to which data breaches have resulted in identity theft is not well known, largely because of the difficulty of determining the source of the data used to commit identity theft. However, available data and interviews with researchers, law enforcement officials, and industry representatives indicated that most breaches have not resulted in detected incidents of identity theft, particularly the unauthorized creation of new accounts. For example, in reviewing the 24 largest breaches reported in the media from January 2000 through June 2005, GAO found that 3 included evidence of resulting fraud on existing accounts and 1 included evidence of unauthorized creation of new accounts. For 18 of the breaches, no clear evidence had been uncovered linking them to identity theft; and for the remaining 2, there was not sufficient information to make a determination. Requiring affected consumers to be notified of a data breach may encourage better security practices and help mitigate potential harm, but it also presents certain costs and challenges. Notification requirements can create incentives for entities to improve data security practices to minimize legal liability or avoid public relations risks that may result from a publicized breach. Also, consumers alerted to a breach can take measures to prevent or mitigate identity theft, such as monitoring their credit card statements and credit reports. At the same time, breach notification requirements have associated costs, such as expenses to develop incident response plans and identify and notify affected individuals. Further, an expansive requirement could result in notification of breaches that present little or no risk, perhaps leading consumers to disregard notices altogether. Federal banking regulators and the President's Identity Theft Task Force have advocated a notification standard--the conditions requiring notification--that is risk based, allowing individuals to take appropriate measures where the risk of harm exists, while ensuring they are only notified in cases where the level of risk warrants such action. Should Congress choose to enact a federal notification requirement, use of such a risk-based standard could avoid undue burden on organizations and unnecessary and counterproductive notifications of breaches that present little risk.

section_title: Letter
paragraphs: As a result of advances in computer technology and electronic storage,  As a result of advances in computer technology and electronic storage,  many different sectors and entities now maintain electronic records  many different sectors and entities now maintain electronic records  containing vast amounts of personal information on virtually all American  containing vast amounts of personal information on virtually all American  consumers. In recent years, a number of entities—including financial  consumers. In recent years, a number of entities—including financial  service firms, retailers, universities, and government agencies—have  service firms, retailers, universities, and government agencies—have  collectively reported the loss or theft of large amounts of sensitive  collectively reported the loss or theft of large amounts of sensitive  personal information. Some of these data breaches—such as those  personal information. Some of these data breaches—such as those  involving TJX Companies and the Department of Veterans Affairs (VA)— involving TJX Companies and the Department of Veterans Affairs (VA)— have received considerable publicity and have highlighted concerns about  have received considerable publicity and have highlighted concerns about  the protections afforded sensitive personal information. Policymakers,  the protections afforded sensitive personal information. information is used fraudulently. The Federal Trade Commission (FTC),  which is responsible for taking complaints from victims and sharing them  with law enforcement agencies, has noted that identity theft is a serious  problem—millions of Americans are affected each year, and victims may  face substantial costs and time to repair the damage to their good name  and credit record.
Although there is no commonly agreed-upon definition, the term “data  breach” generally refers to an organization’s unauthorized or unintentional  exposure, disclosure, or loss of sensitive personal information, which can  include personally identifiable information such as Social Security  numbers (SSN) or financial information such as credit card numbers.  Data breaches can take many forms and do not necessarily lead to identity  theft. The term “identity theft” is broad and encompasses many types of  criminal activities, including fraud on existing accounts—such as  unauthorized use of a stolen credit card number—or fraudulent creation  of new accounts—such as using stolen data to open a credit card account  in someone else’s name. Depending on the type of information  compromised and how it is misused, identity theft victims can face a range  of potential harm, from the inconvenience of having a credit card reissued  to substantial financial losses and damaged credit ratings.
Beginning with California in 2002, at least 36 states have enacted breach  notification laws—that is, laws that require certain entities that experience  a data breach to notify individuals whose personal information was lost or  stolen. There is no federal statute that requires most companies or other  entities to notify affected individuals of data breaches, although federal  banking regulatory agencies have issued guidance on breach notification  to the banks, thrifts, and credit unions they supervise. In addition, the  Office of Management and Budget has issued guidance—developed by the  President’s Identity Theft Task Force—on responding to data breaches at  federal agencies. Because a number of bills have been introduced in  Congress that would establish a national breach notification requirement,  you asked us to review the costs and benefits of such a requirement and  the link between data breaches and identity theft. As agreed with your  offices, this report examines (1) what is known about the incidence and  circumstances of breaches of sensitive personal information; (2) what  information exists on the extent to which breaches of sensitive personal  information have resulted in identity theft; and (3) the potential benefits,  costs, and challenges associated with breach notification requirements.
This report focuses on breaches of sensitive personal data that can be  used to commit identity theft, and not on breaches of other sensitive data,  such as medical records or proprietary business information. To address  the first two objectives, we obtained and analyzed information on data  breaches that have been reported in the media and aggregated by three  private research and advocacy organizations, as well as information on  breaches collected by state agencies in New York and North Carolina,  federal banking regulators, and federal law enforcement agencies. We  also collected information on breaches experienced by federal agencies  compiled by the House Government Reform Committee in 2006 and by the  Department of Homeland Security (DHS). In addition, we conducted a  literature search of relevant articles, reports, and studies. We also  conducted interviews with, and obtained documents from, representatives  of federal agencies, including the FTC, the Department of Justice, DHS,  and the federal banking regulatory agencies; selected state government  agencies and the National Association of Attorneys General; private and  nonprofit research organizations; and consumer protection and privacy  advocacy groups. Further, we obtained information from industry and  trade associations representing key sectors—including financial services,  retail sales, higher education, health care, and information services—that  have experienced data breaches. In addition, for the second objective, we  examined the 24 largest (in terms of number of records breached) data  breaches reported by the news media from January 2000 through June  2005 and tracked by private groups. For each of these breaches, we  reviewed media reports and other publicly available information, and  conducted interviews, where possible, with representatives of the entities  that experienced the breaches, in an attempt to identify any known  instances of identity theft that resulted from the breaches. We also  examined five breaches that involved federal agencies, which were  selected because they represented a variety of different circumstances.  For the third objective, we reviewed the federal banking regulatory  agencies’ proposed and final guidance related to breach notification, and  interviewed representatives of each agency regarding their consideration  of potential costs, benefits, and challenges during development of the  guidance. Further, we reviewed the strategic plan and other documents  issued by the President’s Identity Theft Task Force. In addition, we  conducted a review of the effects of California’s breach notification law,  which included interviewing and gathering information from California  state officials and selected California companies, educational institutions,  and other entities subject to the law’s notification requirements.
We conducted our review from August 2006 through April 2007 in  accordance with generally accepted government auditing standards. A  more extensive discussion of our scope and methodology appears in  appendix I.
subsections: section_title: Background
paragraphs: Breaches of sensitive personal data in recent years at companies,  universities, government agencies, and other organizations have  heightened public awareness about data security and the risks of identity  theft, and have led to the introduction of breach notification requirements  in many state legislatures. As of April 2007, at least 36 states had enacted  some form of law requiring that affected individuals be notified in the  event of a data breach; California’s law, enacted in 2002, was the first such  state requirement. States’ notification requirements vary, particularly with  regard to the applicable notification standard—the event or circumstance  that triggers a required notification. Requirements also vary in terms of the  data to which they apply—for example, some apply to paper documents as  well as electronic records.
There is currently no federal statute that requires most companies and  other entities that experience a data breach to notify individuals whose  personal information was lost or stolen. However, the Gramm-Leach-Bliley  Act established requirements for federally supervised financial institutions  to safeguard customer information. To clarify these requirements, the  federal banking regulators issued interagency guidance in 2005 to the  banks, thrifts, and credit unions they supervise related to their handling of  data breaches. Under this guidance, these institutions are expected to  develop and implement a response program to address unauthorized  access to customer information maintained by the institution or its service  providers; and if they experience a breach, they are to notify their primary  federal regulator as soon as possible and—depending on the  circumstances of the incident—notify their affected customers. In  addition, in September 2006 the President’s Identity Theft Task Force  developed guidance for federal agencies on responding to breaches  involving agency data, including the factors to consider in determining  whether to notify affected individuals. The task force released a strategic  plan for combating identity theft in April 2007, which contained among its  recommendations a proposal for establishing a national breach  notification requirement. Further, in December 2006, the Department of  Veterans Affairs Information Security Enhancement Act of 2006 became  law, which, among other things, requires VA to prescribe regulations  providing for the notification of data breaches occurring at the  department. A number of bills have been introduced in Congress that  would more broadly require companies and other entities to notify  individuals when such breaches occur, and Congress has held several  hearings related to data breaches.
Identity theft occurs when individuals’ identifying information is used  without authorization in an attempt to commit fraud or other crimes.  There are two primary forms of identity theft. First, identity thieves can  use financial account identifiers, such as credit card or bank account  numbers, to take over an individual’s existing accounts to make  unauthorized charges or withdraw money. Second, thieves can use  identifying data, which can include such things as SSNs and driver’s  license numbers, to open new financial accounts and incur charges and  credit in an individual’s name, without that person’s knowledge. This  second form of identity theft is potentially the most damaging because,  among other things, it can take some time before a victim becomes aware  of the problem, and it can cause substantial harm to the victim’s credit  rating. While some identity theft victims can resolve their problems  quickly, others face substantial costs and inconvenience repairing damage  to their credit records. According to FTC, millions of Americans have their  identities stolen each year. Roughly 85 percent of these cases involve the  misuse of existing accounts and 35 percent involve new account creation  or other fraud. (Twenty percent of the total involve both.) Identity thieves  obtain sensitive personal information using a variety of methods. One  potential source is a breach at an organization that maintains large  amounts of sensitive personal information. However, identity theft can  also occur as a result of the loss or theft of data maintained by an  individual, such as a lost or stolen wallet or a thief digging through  household trash.
The Identity Theft and Assumption Deterrence Act of 1998 made identity  theft a federal crime and charged FTC with taking complaints from  identity theft victims; sharing these complaints with federal, state, and  local law enforcement agencies; and providing the victims with  informational materials to assist them. Because identity theft is typically  not a stand-alone crime but rather a component of one or more crimes  such as bank fraud, credit card fraud, and mail fraud, a number of federal  law enforcement agencies can have a role in investigating identity theft  crimes, including the Federal Bureau of Investigation (FBI), U.S. Postal  Inspection Service (USPIS), U.S. Secret Service (Secret Service), the  Office of the Inspector General of the Social Security Administration, and  Immigration and Customs Enforcement.
section_title: Available Evidence Indicates That Data Breaches Occur Frequently and Under Varying Circumstances
paragraphs: Available evidence from media reports, federal and state agencies, and  private institutions, collectively, suggests that data breaches occur with  some frequency. For example, our analysis of the lists of data breaches  compiled by three private research and advocacy organizations shows  more than 570 breaches reported by the news media from January 2005  through December 2006. Data breaches have occurred across a range of  entities, including federal, state, and local government agencies; retailers;  financial institutions; colleges and universities; and medical facilities.  Breaches have varied in size and have resulted from both criminal actions  and accidental incidents. Most of the breaches reported in the news media  have involved data that included personal identifiers such as SSNs, while  others have involved only account information such as credit card  numbers.
subsections: section_title: Several Sources Indicate That Breaches of Sensitive Personal Information Are Frequent
paragraphs: No federal agency or other organization tracks all data breaches, and  definitions of what constitutes a data breach may vary. Although there are  no comprehensive data on the extent of data breaches nationwide,  government officials, trade association representatives, researchers, and  consumer and privacy advocates we interviewed agreed that breaches of  sensitive personal information occur frequently. For example,  representatives of a variety of organizations—including the Department of  Justice, California’s Office of Privacy Protection, the Consumer Data  Industry Association (a trade group representing many information  resellers), and the Ponemon Institute (a private research organization)— characterized data breaches in the United States as being “prevalent” or  “common.” Although we did not identify comprehensive data on the extent  of data breaches, available information from several sources does  corroborate the anecdotal evidence that such breaches occur frequently.
subsections: section_title: Media Reports
paragraphs: Over the past few years, several hundred data breaches have been  reported each year by newspapers and other news media. Three private  organizations that focus on information privacy and security issues— Privacy Rights Clearinghouse, Identity Theft Resource Center, and  Attrition—track data breaches reported in newspapers, magazines, and  other publicly available sources of news and information. Our analysis of  the three lists of data breaches maintained by these organizations  indicated that at least 572 breaches were reported in the news media from  January 2005 through December 2006. These breaches were reported to  have affected more than 80 million records. However, for several reasons,  these lists likely understate the true extent of data breaches in the United  States. First, organizations might not voluntarily disclose data breaches  that they experience. Second, some breaches that organizations do  disclose may not appear in the news media, particularly if the breach was  limited in scope. Finally, the three organizations compiling these lists may  not have identified all of the breaches reported in the news media—for  example, many breaches did not appear on all three lists, suggesting that  none represents an exhaustive list of all breaches that have appeared in  the news.
section_title: Federal Law Enforcement Agencies
paragraphs: Officials at federal law enforcement agencies told us that each year they  conduct a significant number of criminal investigations that involve  alleged breaches of sensitive personal information. For example, officials  of the FBI’s Cyber Division told us that presently it has more than 1,300  pending cases of computer or network intrusions where data breaches  resulted from unauthorized electronic access to computer systems, such  as hackings, at public and private organizations. Officials at the Secret  Service, which investigates certain cases where financial information has  been lost or stolen, told us that in 2006, the service opened 327 cases  involving network intrusions or other breaches at retailers, banks, credit  card processors, telephone companies, educational institutions, and other  organizations. Officials noted that they have seen a steady increase in the  number of data breaches since 1986, when they began tracking computer  fraud violations. Investigators at USPIS, the division of the U.S. Postal  Service that investigates mail fraud, external mail theft, fraudulent  changes of addresses, and other postal-related crimes, told us that the  agency does not specifically track the number of data breaches in the  private sector. However, despite limited data, investigators said their  impression is that such data breaches likely occur frequently.
section_title: House Government Reform Committee and DHS
paragraphs: To obtain information on the prevalence of data breaches at federal  agencies, in July 2006 the House Government Reform Committee asked  federal agencies to provide details about incidents involving the loss or  compromise of any sensitive personal information held by an agency or  contractor from January 1, 2003, through July 10, 2006. Our analysis of the  committee’s report found that 17 agencies reported that they experienced  at least one breach and, collectively, the agencies reported to the  committee more than 788 separate incidents.
The Federal Information Security Management Act of 2002 requires all  federal agencies to report computer security incidents to a federal incident  response center. The U.S. Computer Emergency Readiness Team—a  component of DHS that monitors computer security incidents at federal  agencies—serves as this response center. As such, data breaches at federal  agencies involving certain sensitive information must be reported to the  team within 1 hour of discovery of the incident. DHS staff told us that  they receive information about breaches at federal agencies on a daily  basis. In fiscal year 2006, the center tracked 477 incidents at 59 federal  agencies or at federal contractors with access to government-owned data,  according to information available as of January 29, 2007. In addition, a  March 2007 audit investigation found that at least 490 laptop computers  owned by the Internal Revenue Service and containing taxpayer  information had been lost or stolen since 2003.
section_title: Federal Banking Regulators
paragraphs: The 2005 guidance issued by the five federal banking regulators provided  that a depository institution should notify its primary federal regulator  when it becomes aware of an incident involving unauthorized access to or  use of sensitive customer information. The guidance applies to breaches  that have occurred at the financial institutions themselves, as well as third- party entities such as data processors that act as service providers and  maintain customer information. The five regulators differ in their  methods and criteria for tracking breaches, but collectively they have  tracked several hundred breaches over the past few years at roughly  17,000 institutions they supervise and at third-party entities. For example,  the Federal Deposit Insurance Corporation (FDIC)—the primary federal  supervisor for more than 5,000 state-chartered banks that are not members  of the Federal Reserve System—received reports of 194 breaches at its  regulated institutions from May 2005 through December 2006, as well as  reports of 14 breaches at third-party companies that also affected these  institutions’ customers. Similarly, officials at the Office of Thrift  Supervision—which supervises more than 860 savings associations—told  us that from April 2005 through December 2006, 56 of its institutions  reported breaches at the institution itself and approximately 72 reported  breaches at third-party entities that maintained their customer  information.
section_title: State Agencies
paragraphs: Some states require entities experiencing data breaches to report them to  designated state agencies. For example, the New York State Information  Security Breach and Notification Act requires entities that experience  security breaches to notify the state Attorney General’s Office, Consumer  Protection Board, and the state Office of Cyber Security and Critical  Infrastructure Coordination in cases when New York residents must be  notified. Such data breaches include the unauthorized acquisition of  computerized data that compromises the security, confidentiality, or  integrity of unencrypted private information. Officials of the Office of New  York State Attorney General told us that from December 7, 2005, through  October 5, 2006, their office received notice of 225 breaches. Similarly, a  North Carolina law requires that breaches of personal information  (maintained in computerized, paper, or other media) affecting at least  1,000 persons be reported to the Consumer Protection Division of the state  Office of the Attorney General. An official in that office told us that from  December 2005 through December 2006, it had received reports of 91  breach incidents.
section_title: Other Sources
paragraphs: Information that we obtained from several other sources suggests that  breaches of sensitive personal information occur with some frequency  across a variety of sectors. For example,    EDUCAUSE, a nonprofit association that addresses technology issues  in higher education, conducted a survey in 2005 on data security at  higher education institutions in the United States and Canada. Twenty- six percent of the 490 institutions that responded said they had  experienced a security incident in the past year that resulted in the  compromise of confidential information.
The American Hospital Association collected information, at our  request, in October 2006 from a nonrepresentative group of 46 large  hospitals on breaches of sensitive personal information (excluding  medical records) that they had experienced since January 2003.  Collectively, 13 of the 46 hospitals reported a total of 17 data breach  incidents.
The Ponemon Institute, a private company that researches privacy and  security practices, conducted a survey of 51,433 U.S. adults and  received responses from 9,154 (a response rate of about 18 percent).  About 12 percent of the survey respondents said they recalled receiving  notification of a data security breach involving their personal  information.
The CMO Council, an organization serving marketing executives,  reported that 16 percent of consumers who responded to a Web-based  panel reported that a company had lost or compromised their personal,  financial, or medical information. An additional 32 percent of  respondents said they were not sure.
Several other studies, while not focusing specifically on breaches of  sensitive personal information, have found more generally that  information security vulnerabilities are widespread among U.S. and  global companies.
Information from multiple sources indicates that data breaches at  companies, government agencies, retailers, and other entities have  occurred frequently in recent years, involving millions of records of  sensitive personal information. We have reported in the past that no  federal law explicitly requires most companies and other entities to  safeguard all of the sensitive personal information they may hold. We also  have suggested that to ensure that sensitive personal information is  protected on a more consistent basis, Congress should consider expanding  requirements to safeguard such information. The frequency of data  breaches identified in this report underscores the need for entities in the  public and private sectors to improve the security of sensitive personal  information and further corroborates that additional federal action may be  needed in this area.
section_title: Source, Cause, Size, and Content of Breaches Have Varied Widely
paragraphs: According to government officials, researchers, and media reports, data  breaches have occurred among a wide variety of entities and as a result of  both intentional actions and accidental losses. These breaches also have  varied in size and in the types of data compromised.
subsections: section_title: Type of Entity
paragraphs: Data breaches have been reported at a wide range of public and private  institutions, including federal, state, and local government agencies; public  and private colleges and universities; hospitals and other medical facilities;  retailers; banks and other financial institutions; information resellers; and  others. For example, in the weeks leading up to the highly publicized 2005  CardSystems breach, the media also had reported breaches at, among  other entities, a large hospital, a university, a global financial institution, a  federal regulatory agency, and a major technology company.
According to Attrition, of the breaches it tracked as reported in the news  media in 2005 and 2006, 33 percent of the breaches occurred at  educational institutions, 32 percent at financial services institutions, 25  percent at government agencies, and 10 percent at medical facilities,  although breaches reported in the news media may not be representative  of all breaches. Similarly, the data security firm ID Analytics examined 70  data breaches that were reported by the news media from February  through September 2005. According to company officials, 46 percent of  these breaches occurred at educational institutions, 16 percent at financial  institutions, 14 percent at retailers, 11 percent at government agencies, 7  percent at medical facilities, and 6 percent at information resellers.
Another way to analyze where data breaches have occurred is to look at  the number of records breached (as opposed to the number of breaches  themselves). Our analysis of the list maintained by Attrition found that 54  percent of breached records involved financial institutions, 34 percent  involved government agencies, 4 percent involved educational institutions,  and 3 percent involved medical facilities. ID Analytics’ report found that 57  percent of breached records involved financial institutions, 22 percent  involved retailers, 13 percent involved educational institutions, 4 percent  involved information resellers, 2 percent involved government agencies,  and 2 percent involved medical facilities.
section_title: Cause of Breach
paragraphs: According to government officials, researchers, and media reports, data  breaches of sensitive personal information have occurred as a result of  both intentional actions as well as negligence or accidental losses. In some  cases, individuals intentionally steal information for the purpose of  committing fraud or identity theft. Breaches involving intentional actions  have included:    Hacking, or accessing computer systems without authorization. For  example, in 2007 the retailer TJX Companies reported unauthorized  intrusions into its computer systems that may have breached millions  of customers’ credit card and driver’s license information.
Employee theft. For example, in 2006, a former employee of the  American Red Cross pled guilty to stealing personally identifiable  information from a blood donor database.
Theft of physical equipment. In 2005, for instance, a laptop containing  the names and SSNs of more than 98,000 students, alumni, and others  was stolen from the University of California at Berkeley.
Deception or misrepresentation to obtain unauthorized data. In 2005,  the information reseller ChoicePoint acknowledged that the personal  records it held on approximately 162,000 consumers had been  compromised by individuals who posed as legitimate subscribers to the  company’s information services.
Breaches involving negligence or accidental losses of data have included  the following:    Loss of laptop computers or other hardware. For example, in 2006, the  Department of Labor reported that an employee lost a laptop  containing personal information on 1,137 individuals.
Loss of data tapes. For example, in 2004, Bank of America lost backup  tapes containing personal information of 1.2 million government charge  card holders while the tapes were being transported to a data center.
Unintentional exposure on the Internet. In 2006, according to media  reports, the U.S. Department of Education left unprotected on a Web  site the personally identifiable information, including SSNs, of up to  21,000 recipients of federal student loans.
Improper disposal of data, such as leaving sensitive personal data on  unshredded documents in a publicly accessible dumpster.
We did not identify comprehensive data that reliably provide overall  statistics on the causes of known data breaches. However, our review of  the 24 largest data breaches reported in the news media (discussed in  more detail later in this report) found that 12 breaches apparently involved  intentional acts by hackers or employees illegally accessing or using data,  5 involved stolen laptops or other computer equipment, 4 involved lost  computer backup tapes, 2 involved the use of deception to gain access to  data, and 1 involved the possible unauthorized disclosure of data. In  addition, some studies indicate that most breaches reported in the news  media resulted from intentional acts rather than accidental occurrences  such as a lost laptop computer. For example, in its study of 70 breaches,  ID Analytics determined that 48 involved thefts committed with the  apparent intention of accessing sensitive data. Eleven of the breaches  involved thefts where sensitive consumer information was apparently  stolen inadvertently as part of another crime (such as the theft of a laptop  computer for its resale value), and another 11 breaches involved  accidental loss (such as misplacement of a laptop computer). However,  these data may overrepresent the proportion of all breaches that involve  criminal activity, as such breaches are probably more likely than  accidental losses to be reported to authorities and by the news media.
section_title: Number of Records Breached
paragraphs: Our analysis of the list maintained by Attrition of breaches reported by the  news media found the median number of records breached to be 8,650.  However, these data breaches varied considerably in size—ranging, for  example, from a breach involving 10 records at a law firm to a breach  involving as many as tens of millions of records at a credit card processing  company. The breaches involving federal agencies that were reported to  the House Government Reform Committee also varied in size—for  example, several affected fewer than five records, while a breach at VA  affected 26.5 million records.
section_title: Types of Data Breached
paragraphs: Comprehensive information does not exist on the types of data involved in  all known data breaches. Among the list maintained by Attrition of  breaches reported by the news media in 2005 and 2006—which may not be  representative of all breaches—more than half involved SSNs and 11  percent involved credit card numbers (and 3 percent of the total involved  both). In the remaining breaches, other types of account or personal  information were involved, or the type of data breached was not reported.  Logically, there may be an association between the type of data  compromised and the type of entity experiencing the breach. For example,  several educational institutions have experienced breaches of SSNs, which  they may maintain as student identifiers, and several retail stores have  experienced breaches of credit card numbers, which they often maintain  on their customers.
section_title: Consequences of Data Breaches Are Not Fully Known, but Clear Evidence of Identity Theft Has Been Found in Relatively Few Breaches
paragraphs: Comprehensive information on the outcomes of data breaches is not  available. Several cases have been identified in which a data breach  appears to have resulted in identity theft, but available data and  information from law enforcement and industry association  representatives indicated that most breaches have not resulted in detected  incidents of identity theft. For example, of 24 very large breaches we  reviewed, 3 appeared to have resulted in fraud on existing accounts and 1  in the unauthorized creation of new accounts. Determining the link  between data breaches and identity theft is challenging because, among  other things, identity theft victims often do not know how their personal  information was obtained. However, the circumstances of a breach,  including the type of information compromised and how the breach  occurred, can greatly affect the potential risk of identity theft.
subsections: section_title: Federal Law Enforcement Agencies and Industry Associations Identified Limited Instances of Breaches Leading to Identity Theft
paragraphs: In general, representatives of law enforcement agencies, industry and  trade associations, and consumer and privacy advocacy organizations told  us that no comprehensive data are available on the consequences of data  breaches. Several cases have been identified where there is evidence that a  data breach resulted in identity theft, including account fraud or  unauthorized creation of new accounts. At the same time, available data  and information from the officials we contacted indicated that most  breaches have not resulted in detected incidents of identity theft.
We asked representatives of the FBI, Secret Service, USPIS, and  Immigration and Customs Enforcement—a component of DHS that has  investigated cases where stolen identities were used to secure jobs—the  extent to which data breaches they investigated resulted in some form of  identity theft. Representatives of all of these agencies told us that their  investigations of data breaches do not typically allow them to fully  ascertain how stolen data are used. Similarly, they noted that  investigations of identity theft do not always reveal the source of the data  used to commit the crime.
However, the representatives were able to provide us with a limited  number of examples in which data breaches they investigated had  allegedly resulted in some form of identity theft. For example, in a 2006  investigation by USPIS, an employee of a credit card call center allegedly  compromised at least 35 customers’ accounts and used some of the  information to purchase approximately $65,000 in gift cards. The  representatives of federal law enforcement agencies noted that cases in  which data breaches have been linked to identity theft often have involved  instances of unauthorized access by employees. For example, an official at  Immigration and Customs Enforcement stated that her agency, in  cooperation with other agencies, has investigated cases in which  government employees allegedly had improperly accessed and sold  sensitive personal information that was then used by illegal immigrants to  secure employment.
In addition, in 2005 FTC settled charges with BJ’s Wholesale Club in which  alleged security breaches resulted in several million dollars in fraudulent  purchases using customers’ credit and debit card data. As discussed later  in this report, FTC has also taken enforcement actions related to data  breaches at several other companies, including ChoicePoint, CardSystems,  and DSW, in which it uncovered evidence that the breaches resulted in  identity theft.
Many of the law enforcement officials said that, based on their experience,  data breaches that result in harm have usually involved fraud on existing  accounts (such as credit card fraud) rather than the unauthorized creation  of new accounts. Secret Service representatives noted that using illicit  credit and debit card numbers and bank account information is much  easier and less labor intensive than using personally identifiable  information to fraudulently open new accounts. Officials at Secret Service,  FBI, and USPIS all said that identity theft involving the creation of new  accounts often results not from data breaches, but from other sources,  such as retrieving personal information by sifting through a family’s  household trash.
In examining a selection of five breaches that occurred from 2003 through  2005 that were reported as having involved five federal agencies— Department of Justice, FDIC, Internal Revenue Service, National Park  Service, and the Navy—we found that the circumstances behind these  breaches varied widely. At least two of the breaches occurred at vendors  or contractors that held sensitive data on agency employees, rather than at  the agency itself. In addition, we found that a breach reported in the news  media as having involved the National Park Service actually involved a  not-for-profit organization that manages eParks, according to a  representative of that organization. Four of the five breaches reported as  having involved federal agencies were not believed to have resulted in  identity theft, according to officials of the entities involved. The breach at  FDIC resulted in an estimated 27 cases of identity theft when data  inappropriately accessed by a former FDIC intern were used to take out  more than $425,000 in fraudulent loans in the names of FDIC employees,  according to agency officials.
Industry and trade associations representing entities that maintain large  amounts of information—banks, retailers, colleges, information resellers,  and hospitals—told us that they had limited knowledge about the harm  caused by data breaches that occur in their industries. However, in some  cases, they provided information or anecdotal evidence on the extent to  which such breaches may have led to some form of identity theft. For  example, the 46 hospitals that the American Hospital Association surveyed  at our request reported that of 17 breaches that had occurred since 2003,  three had resulted in fraudulent activity on existing accounts and another  three resulted in other forms of identity theft, including one case where  the information was used to file false income tax refunds. The identity  theft in these cases involved small numbers of victims—usually just one.
Representatives of the American Council on Education and two other  higher education associations stated that while data breaches at colleges  and universities were not uncommon, they were aware of little to no  identity theft that had resulted from such breaches. Representatives of the  American Bankers Association, the National Retail Federation, and the  Consumer Data Industry Association told us they were unable to  determine how prevalent data breaches are among their institutions or  how often such breaches lead to consumer harm. Representatives at the  National Retail Federation noted that breaches at retailers may be more  likely to result in fraud on existing accounts than in new account creation,  since most retailers do not maintain the personally identifiable  information needed to steal someone’s identity.
section_title: Of 24 Large Publicly Reported Breaches, 4 Apparently Resulted in Known Cases of Identity Theft
paragraphs: Using lists of data breaches compiled by the Identity Theft Resource  Center, Privacy Rights Clearinghouse, and Congressional Research  Service, we identified the 24 largest breaches (measured by number of  records) that were reported in the news media from January 2000 through  June 2005. To gather information on these incidents, we interviewed or  collected written responses from representatives of the entity  experiencing the breach and reviewed publicly available information, such  as media reports, news releases, testimonies, and court documents. In  some cases, when feasible, we also spoke with law enforcement  investigators. We identified those cases where this information collectively  indicated that the breach appeared to have resulted in some form of  identity theft. Ultimately, the determination of whether particular conduct  violated a law prohibiting identity theft would be a matter of law for the  courts.
Although these lists characterized each of these 24 incidents as data  breaches, the circumstances of the incidents varied. While 19 of the  incidents clearly met our definition of data breach (i.e. unauthorized or  unintentional exposure, disclosure, or loss of sensitive personal  information), four cases involved hackers who may or may not have  actually accessed sensitive information. In one other incident, a university  employee with access to sensitive personal data was indicted on unrelated  fraud charges. A university official told us he did not believe this incident  should necessarily be characterized as a data breach since there was no  evidence the employee actually misused university data.
The available evidence that we reviewed indicated that 18 of these 24  breaches were not known to have resulted in any identity theft. As shown  in table 1, three breaches were believed to have resulted in account fraud  and one resulted in the unauthorized creation of new accounts. In two  other cases, we were not able to gather sufficient information on whether  harm appeared to have resulted from the breach. Further, because of the  challenges in linking data breaches with identity theft, in some cases our  review may not have uncovered instances of harm potentially resulting  from these breaches. In some instances, investigators or company  representatives reported that they were able to determine with a high  degree of certainty—through forensic investigation or other means—that  unauthorized parties had not accessed the data. In other instances, these  representatives said that they were not aware of any account fraud that  resulted, but they acknowledged that there was no way to know for sure.  Moreover, determining potential harm may be particularly challenging  with very large breaches because the volume of records involved can  make it difficult to link individual victims to the breach.
The one large breach we identified that apparently resulted in the  unauthorized creation of new accounts involved ChoicePoint, an  information reseller. In 2005, the company acknowledged that the personal  records it held on approximately 162,000 consumers had been  compromised by individuals who posed as legitimate subscribers to the  company’s information services. FTC reached a civil settlement in 2006  with the company that established a fund for consumer redress to  reimburse potential victims of identity theft, and the agency has worked  with law enforcement officials to identify such victims.
The three large breaches we identified that appeared to result in fraud on  existing accounts included the following:    CardSystems, a credit card payment processor, reported a May 2005  breach in which a hacker accessed data such as names, card account  numbers, and expiration dates. The total number of compromised  accounts is unclear. FTC staff alleged in a 2006 civil complaint that the  breach had compromised data associated with tens of millions of credit  and debit cards, but a CardSystems official stated in congressional  testimony that only 239,000 accounts were compromised. Officials of  the Office of the Comptroller of the Currency—who surveyed the  national banks they supervise in order to determine the amount of  fraudulent charges that resulted from the breach—said that customers  of 110 banks were affected by this incident and losses of more than $13  million in fraudulent charges on customers’ cards were reported by 24  of these institutions.
DSW, a shoe retailer, said in an April 2005 news release that it had  experienced a data breach in which a hacker accessed the names and  card numbers associated with 1.4 million credit and debit card  transactions at 108 of its stores, as well as checking account numbers  and driver’s license numbers from 96,000 check transactions.  According to a complaint filed by FTC in March of 2006, there allegedly  have been fraudulent transactions on some of these accounts.
CD Universe, an Internet-based music store, reportedly experienced a  breach in December 1999 in which a hacker accessed as many as  300,000 names, addresses, and credit card numbers from the company  Web site, according to media reports and a company official. The  hacker allegedly used some of the stolen credit card numbers to obtain  money for himself.
section_title: Challenges Exist in Determining the Link between Data Breaches and Identity Theft
paragraphs: Determining the link between data breaches and identity theft is  challenging for several reasons. First, identity theft victims often do not  know how their personal information was obtained. According to FTC, in  approximately 65 percent of the identity theft complaints it received from  October 1, 2005, through August 31, 2006, the victim did not know or  report how the information was compromised. Second, victims may  misattribute how their data were obtained. For example, federal officials  and representatives of a private group that assists victims said that  consumers who are notified of a breach often assume that any perceived  mistakes on their credit card statements or credit report were a result of  the breach. As a result, no government agency maintains comprehensive  data on the underlying cause of identity theft. FTC told us that its Identity  Theft Data Clearinghouse is limited to self-reported complaints and  therefore does not contain statistically reliable information that would  allow the agency to determine a link between data breaches and identity  theft. Similarly, according to FBI, data maintained by the Internet Crime  Complaint Center does not include information sufficient to determine the  link between data breaches and identity theft.
Third, law enforcement officials told us that in some cases, stolen data  may be held for up to a year or more before being used to commit identity  theft. Further, once stolen data have been sold or posted on the Web,  fraudulent use of that information may continue for years. As a result,  studies that attempt to measure the harm resulting from data breaches  cannot necessarily rule out all future harm. Finally, conducting  comprehensive studies of data breaches and identity theft can be hindered  by issues of privacy and confidentiality. For example, companies that have  experienced breaches may be unable or unwilling to provide information  about affected individuals to researchers.
Some studies conducted by private researchers have sought to determine  the extent to which data breaches result in identity theft, but our review  found them to contain methodological limitations. One research firm  conducted a study of four data breaches, analyzing credit and other  application data for suspicious relationships that indicated fraud. The  study estimated that no more than 0.10 percent of individuals whose data  had been breached experienced resulting identity theft in the form of  unauthorized new account creation. However, because the study reviewed  only four data breaches, it cannot be considered representative of other  breaches. Moreover, two of these breaches did not involve personally  identifiable information and thus would not be expected to create a risk of  fraud involving new account creation.
Another private research firm surveyed approximately 9,000 individuals  about whether they had ever received a notification from an organization  about the loss or theft of their personal information. Of the  approximately 12 percent of individuals who reported they had received  such a notification, 3 percent—or 33 people—said they believed they had  suffered identity theft as a result. However, these data are subject to  limitations; among other things, individuals are often unaware of whether  any fraud they have suffered was, in fact, due to a data breach. A third firm  projected in a study that 0.8 percent of consumers whose information a  data breach compromised would experience fraud as a result. However,  we question the reliability of this estimate, in part because of assumptions  made about the number of consumers affected by data breaches.
section_title: Type of Data Compromised and Other Factors Influence Potential for Resulting Consumer Harm
paragraphs: The type of data compromised in a breach can effectively determine the  potential harm that can result. For example, credit or debit card  information such as card numbers and expiration dates generally cannot  be used alone to open unauthorized new accounts. Some of the largest and  most highly publicized data breaches in recent years largely involved  credit or debit card data rather than personally identifiable information. As  a result, these breaches put affected consumers at risk of account fraud  but not necessarily at risk of fraud involving unauthorized creation of new  accounts—the type of identity theft generally considered to have a more  harmful direct effect on consumers. While credit and debit card fraud is a  significant problem—the FTC estimates it results in billions of dollars in  losses annually—existing laws limit consumer liability for such fraud and,  as a matter of policy, some credit and debit card issuers may voluntarily  cover all fraudulent charges. In contrast, the unauthorized creation of  new accounts—such as using someone else’s identity to open credit card  or bank accounts, originate home mortgages, file tax returns, or apply for  government benefits—can result in substantial financial costs and other  hardships.
In addition to the type of data compromised in a breach, several additional  factors can influence the extent to which a breach presents the risk of  identity theft. These include the following:  Intent. Breaches that are the result of intentional acts—such as  hacking into a server to obtain sensitive data—generally are considered  to pose more risk than accidental breaches such as a lost laptop or the  unintentional exposure of sensitive data on the Internet, according to  federal agency officials. However, in some cases, such as the theft of a  laptop containing personal information, it may be unknown whether  the laptop was stolen for the hardware, the personal data, or both.
Encryption. Encryption—encoding data so that it can only be read by  authorized individuals—can in some cases prevent unauthorized  access. However, some forms of encryption are more effective than  others, and encryption does not necessarily preclude fraudulent use of  data—for example, if the key used to unencrypt the data is also  compromised.
Hardware requirements. Data that only can be accessed using  specialized equipment and software may be less likely to be misused in  the case of a breach. For example, some entities that have lost data  tapes have stated that criminals would require specific data reading  equipment and expertise in how to use it to access the information.
Number of records. Larger breaches may pose a greater overall risk  that at least one individual would become a victim of identity theft. At  the same time, given the resources needed to commit identity theft,  breaches of very large numbers of records may pose less risk to any  one individual whose data were compromised.
section_title: Breach Notification Requirements Can Serve to Encourage Better Data Security Practices and Alert Consumers, but They Also Present Costs and Challenges
paragraphs: Breach notification requirements have several potential benefits, including  creating incentives for entities to improve their data security practices  (and thus prevent potential breaches from occurring), allowing affected  consumers to take measures to prevent or mitigate identity theft, and  serving to respect individuals’ basic right to know when their personal  information is compromised. At the same time, breach notification  requirements present costs, both for developing compliance strategies and  for actual notifications in the event of a breach. Further, there is the risk of  overnotification, or inundating consumers with frequent notifications of  breaches that may present little or no risk of identity theft or other harm.  Thus, policymakers face the challenge of setting a notification standard  that allows individuals to take steps to protect themselves where the risk  of harm exists, while ensuring they are only notified in cases where the  level of risk warrants such action.
subsections: section_title: Notification Requirements May Create Incentives for Improved Data Security and Allow Consumers the Opportunity to Mitigate Risks
paragraphs: According to our review of studies and interviews with representatives in  government, academia, and private industry, breach notification  requirements have several potential benefits, as follows:  Incentives for Improved Data Security. Breach notification  requirements can provide an incentive for companies and other entities  to increase their data security measures to avoid the possible financial  and reputational risks that can be associated with a publicly reported  data breach. Representatives we contacted in the private, nonprofit,  and government sectors told us that they believe that existing breach  notification requirements in state laws, or the breach notification  provisions in federal banking regulatory guidance, have provided  entities with incentives to improve data security practices. For  example, some representatives of companies and other organizations  noted that passage of state notification laws led to companies  reexamining data security procedures and making improvements, such  as encrypting sensitive data and restricting consumer data that can be  accessed online. Similarly, federal banking regulators told us that they  believe their notification guidance has motivated regulated institutions  to enhance data security. For example, according to officials at the  Office of Thrift Supervision, its institutions have taken steps such as  improving electronic firewalls and implementing formal incident  response reporting systems.
Prevention of Identity Theft. Breach notification can provide  consumers with the opportunity to take steps to protect themselves  from possible identity theft. For example, consumers whose account  information has been breached can monitor their bank or credit card  statements for suspicious activity or close the affected accounts.  Consumers whose personally identifiable information, such as SSN, has  been breached can review their credit reports for suspicious activity or  may choose to purchase a credit monitoring product that alerts them to  changes that could indicate identity theft. In addition, affected  consumers can place a fraud alert on their credit reports, which  requires businesses to take certain identity verification steps before  issuing credit. In some states, consumers can implement credit  freezes, which block unauthorized third parties from obtaining the  consumer’s credit report or score. Limited information exists on the  steps individuals actually take when notified of a breach. In the 2005  Ponemon Institute survey of individuals that received notification  letters, 50 percent said they did nothing, while the rest indicated they  took actions such as monitoring their credit reports, canceling credit or  debit cards, or closing bank accounts.
Respecting Consumers’ Right to Know. Some consumer advocates and  others have argued that consumers have a right to know how their  information is being handled. According to this view, basic rights of  privacy dictate that consumers should be informed when their personal  information has been compromised, even if the risk of harm is minimal.  The principle that individuals should have ready means of learning  about the use of their personal information is embedded in the Fair  Information Practices, a set of internationally recognized privacy  protection principles.
Improving Public Awareness. Public reporting of data breaches may  raise general awareness among consumers about the risks of identity  theft and ways they can mitigate these risks, such as periodically  reviewing their credit reports. In addition, publicity surrounding a data  breach resulting from notification can serve to deter the use of stolen  information because presumably the thief knows that the breach is  likely being investigated and the stolen data are being carefully  monitored.
section_title: Breach Notification Requirements Present a Variety of Potential Costs
paragraphs: According to company representatives, researchers, regulators, and  others, there are several different types of costs that may be associated  with breach notification requirements. To begin with, entities subject to  breach notification requirements may incur certain costs, regardless of  whether they actually suffer a breach, or—if they do—regardless of  whether they have to notify consumers. For example, entities may incur  costs for developing and formalizing incident response plans.
There are also the costs associated with actual notifications—potentially  including printing, postage, legal, investigative, and public relations  expenses. Although comprehensive data on these costs do not exist, a  2006 Ponemon Institute survey of companies experiencing a data breach  found that 31 companies that responded incurred an average of $1.4  million per breach, or $54 per record breached, for costs related to mailing  notification letters, call center expenses, courtesy discounts or services,  and legal fees. Similarly, a study by Gartner Research found that  ChoicePoint spent $79 per affected account following its 2005 breach for  professional fees, legal expenses, and communications to affected  customers. A representative of the San Jose Medical Group told us it  spent $100,000 to send notification letters to 187,000 patients following a  data breach that occurred in 2005. Entities also may incur costs related to  staffing call centers to field inquiries from consumers about the breach.  For example, representatives of the University of California at Berkeley  told us that following a 2005 breach of 98,000 records, the university spent  $75,000 in staffing, telecommunications, and other call center costs.
Finally, banks whose customers’ account information is breached also  may incur costs for remedial steps such as canceling existing accounts or  replacing affected customers’ credit or debit cards—although such steps  may not be required by the applicable breach notification requirements.
Entities experiencing a breach also often provide affected individuals with  free credit monitoring services. For example, a representative of a large  financial management company noted that offering free credit monitoring  services after a breach has become standard industry practice, and costs,  on average, between $20 and $40 per customer.
section_title: Challenges Exist in Complying with and Developing Breach Notification Requirements
paragraphs: Officials of companies and other entities we interviewed identified  challenges such as interpreting ambiguous statutory language, identifying  and locating affected consumers, and developing effective notification  letters. In addition, policymakers face challenges in developing breach  notification requirements, particularly in setting the appropriate standard  to establish the circumstances under which consumers should be notified.
subsections: section_title: Complying with Notification Requirements
paragraphs: Companies and other entities we interviewed said they can face a number  of challenges related to complying with the breach notification  requirements in state laws or federal banking guidance. These include the  following:  Interpreting ambiguous provisions. Entities subject to breach  notification requirements sometimes face challenges interpreting  certain terms or provisions of notification laws. For example, an  information security expert told us that some laws do not adequately  define encryption, which could refer to anything from simple password  protection to complex coding. Similarly, federal banking regulators  acknowledged that their institutions sometimes face difficulty  determining whether misuse of breached information is “reasonably  possible,” such as when little information exists about the location of  the data, the intent of a criminal who stole data, or the effectiveness of  security features designed to render data inaccessible.
Addressing who is responsible. Notification requirements do not  always fully address who should bear the cost of and responsibility for  notification, particularly in cases where a third party is responsible for  the breach. For example, representatives of some federal banking  regulators and industry associations cited particular challenges  associated with breaches of credit and debit card information by  retailers. Banks that issue credit and debit cards compromised by a  merchant that is not the bank’s service provider are generally not  required by the banking regulators’ guidance to notify their customers,  but nevertheless in some cases, they feel obliged to do so. Bank  representatives with whom we spoke expressed concern that breaches  of credit card information by third parties can adversely affect a bank’s  reputation and result in costs related to notifying customers and  reissuing cards.
Identifying affected consumers. Some entities we interviewed said  that it can be difficult to identify which consumers may have been  affected by a breach and obtain their contact information. For example,  one representative at a state agency involved in a breach told us  officials were unsure what data had been downloaded among records  that may have been accessed on 600,000 people. Obtaining accurate  and current mailing addresses for affected parties also can be difficult  and costly, many entities told us. This can be a particular problem for  entities, such as merchants, that have breached credit card numbers  but do not themselves possess the mailing addresses associated with  those numbers.
Developing clear and effective notification letters. We have noted in  the past that public notices should be useful and easy to understand if  they are to be effective. However, the 2005 study conducted by the  Ponemon Institute found that 52 percent of survey respondents who  received a notification letter said the letter was not easy to  understand. In addition, consumers might be confused by other mail  solicitations that may resemble notification letters. For example,  officials at one large national bank noted that marketing solicitations  for credit monitoring services often are made to resemble breach  notification letters, potentially desensitizing or confusing consumers  when a true notification letter arrives.
Complying with multiple state laws. Officials of companies with  customers in multiple states and their trade associations noted that  they face the challenge of complying with breach notification  requirements that vary among the states, including who must be  notified, the level of risk that triggers a notice, the nature of the  notification, and exceptions to the requirement. Officials of companies  we contacted noted that it is challenging to comply with these multiple  requirements since most breaches involve customers in many states.
section_title: Setting an Appropriate Notification Standard
paragraphs: Existing state laws vary in terms of the notification standard—that is, the  event or circumstance that triggers a required notification. For example,  California has an expansive standard that requires notification in nearly all  cases where unencrypted sensitive personal data “is reasonably believed  to have been acquired by an unauthorized individual.” Other states employ  a risk-based approach that incorporates into the standard the extent to  which the data are likely to be misused. The standards vary in terms of  what is required in cases where the risk of harm is unknown. For example,  Vermont requires notification unless an entity can demonstrate that  misuse of the breached data “is not reasonably possible.” In contrast,  North Carolina requires notification only when it has been determined that  the breach has resulted, or is reasonably likely to result, in illegal use of  the data or creates a material risk of harm to a consumer. As shown in  figure 1, whether or not a breach is subject to notification can depend on  the specific notification standard.
Because of the difficulty of complying with multiple state requirements,  many companies and industry representatives have argued for a consistent  federal standard for breach notification that would preempt state  notification laws. However, the National Association of Attorneys General,  as well as some consumer and privacy groups, have expressed concern  that a federal breach notification law could weaken consumer protections  if it were to preempt stronger state laws. These groups have advocated a  strong notification standard because, they say, the link between breaches  and identity theft is not always clear and entities are not well equipped to  assess the risk of harm resulting from a given breach. As a result, too  narrow a notification standard may prevent consumers from taking action  in cases that do in fact present some risk. Also, as noted earlier, some  privacy groups and others believe that consumers have basic rights to be  notified when their personal information has been breached, no matter  what the circumstances. Moreover, they say that fears of  “overnotification”—where consumers are inundated by frequent  notifications—are unfounded, given that they are aware of no evidence of  this occurring in states that currently have strict notification requirements.
By contrast, some representatives of the federal banking regulatory  agencies, FTC, private companies, and other experts have expressed  concern about overly expansive breach notification standards. They say  that such standards may require businesses to notify consumers about  minor and insignificant breaches. This in turn could eventually lead to  overnotification and cause consumers to spend time and money taking  proactive steps that are not necessary or, alternatively, to ignore notices  when action is warranted. In addition, businesses and federal banking  regulators have expressed concern about the financial burden that  overnotification could cause. Overly broad notification standards could  also have the effect of limiting entities’ reputational incentives for  improving data security, if nearly all entities regularly issue notifications  as a result of minor breaches. Representatives of the federal banking  regulatory agencies have noted that they sought to strike an appropriate  balance with their notification standard. Their guidance provides that,  when a financial institution becomes aware of an incident of unauthorized  access to sensitive customer information, the institution should conduct a  reasonable investigation to promptly determine the likelihood that the  information has been or will be misused. If the institution determines that  misuse of the information has occurred or is reasonably possible, it should  notify affected customers as soon as possible. The guidance is intended to  provide notice to customers only when there is a reasonable expectation  of misuse.
Similarly, the guidance for federal agencies developed by the President’s  Identity Theft Task Force recommended that if an agency experiences a  breach, it should analyze the risk of identity theft and tailor its response— which may include notifying individuals—to the nature and scope of the  risk presented. The guidance noted that such a risk assessment can  minimize the potentially significant costs of notification where little risk  exists. The task force’s April 2007 strategic plan recommended the  development of a national standard requiring all entities that maintain  sensitive consumer information, in both the public and private sectors, to  provide notice to consumers and law enforcement in the event of a breach.  As with its guidance to federal agencies, the task force recommended that  the standard be risk based to provide notice when consumers face a  significant risk of identity theft but to avoid excessive notification.
As we have noted in the past, care is needed in defining appropriate  criteria for data breaches that merit notification. The frequency of data  breaches identified in this report suggests that a national breach  notification requirement may be beneficial, in large part because of its role  in further encouraging entities to improve their data security practices.  However, because breaches vary in the risk they present, and because  most breaches have not resulted in detected incidents of identity theft, a  notification that is risk based appears appropriate. Should Congress  choose to enact a federal breach notification requirement, use of the risk- based approaches that the federal banking regulators and the President’s  Identity Theft Task Force advocate could avoid undue burden on  organizations and unnecessary and counterproductive notifications to  consumers.
section_title: Agency Comments
paragraphs: We provided a draft of this report to FTC, which provided technical  comments that were incorporated in this report as appropriate. In  addition, we provided selected portions of the draft to the Board of  Governors of the Federal Reserve System, the Department of Justice, DHS,  FDIC, the National Credit Union Administration, the Office of the  Comptroller of the Currency, the Office of Thrift Supervision, the Social  Security Administration, and USPIS, and also incorporated their technical  comments as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution of it until 30 days from  the date of this letter. We will then send copies of this report to the  Chairman, House Committee on Financial Services; the Chairman and  Ranking Member, Senate Committee on Banking, Housing, and Urban  Affairs; the Chairman and Ranking Member, Senate Committee on the  Judiciary; the Chairman and Ranking Member, House Committee on the  Judiciary; the Chairman and Vice Chairman, Senate Committee on  Commerce, Science, and Transportation; and the Chairman and Ranking  Member, House Committee on Energy and Commerce. We will also send  copies to the Chairman of the Board of Governors of the Federal Reserve  System, the Attorney General, the Secretary of the Department of  Homeland Security, the Chairman of the Federal Deposit Insurance  Corporation, the Chairman of the Federal Trade Commission, the  Chairman of the National Credit Union Administration, the Comptroller of  the Currency, the Director of the Office of Thrift Supervision, the  Commissioner of the Social Security Administration, and the Postmaster  General and Chief Executive Officer of the U.S. Postal Service. We will  also make copies available to others upon request. In addition, the report  will be available at no charge on GAO’s Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-8678 or woodd@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made key contributions to this report are  listed in appendix II.
section_title: Appendix I: Scope and Methodology
paragraphs: Our report objectives were to examine (1) what is known about the  incidence and circumstances of breaches of sensitive personal  information; (2) what information exists on the extent to which breaches  of sensitive personal information have resulted in identity theft; and (3)  the potential benefits, costs, and challenges associated with breach  notification requirements. We use the term “data breach” to refer to the  unauthorized or unintentional exposure, disclosure, or loss of sensitive  personal information by a company, government agency, university, or  other public or private entity. Our scope was limited to breaches involving  personal data, including financial data, that could be used to commit  identity theft or other related harm, and we excluded breaches involving  other types of sensitive data, such as medical records or proprietary  business information. For the purposes of this report, the term “identity  theft” is used broadly to refer to both fraud on existing accounts and the  unauthorized creation of new accounts.
To address all three objectives, we conducted a literature search of  relevant articles, reports, and studies. We also collected and analyzed  documents from, and interviewed, officials of government agencies that  investigate and track data breaches, including the Federal Trade  Commission, the Department of Homeland Security, the Department of  Justice, the U.S. Postal Inspection Service, and the Social Security  Administration. We also interviewed staff at the five federal banking  regulators—the Board of Governors of the Federal Reserve System, the  Federal Deposit Insurance Corporation, the Office of the Comptroller of  the Currency, the Office of Thrift Supervision, and the National Credit  Union Administration. In addition, we spoke with representatives of the  National Association of Attorneys General and organizations that address  consumer protection and privacy issues, including Consumers Union,  Electronic Privacy Information Center, Privacy Rights Clearinghouse,  Attrition, and the Identity Theft Resource Center. We also spoke with  three academic researchers who study issues related to data breaches and  notification and an attorney who helps companies address data privacy  and security issues. In addition, we reviewed studies on data breaches  conducted by private and nonprofit research organizations, including the  Ponemon Institute, ID Analytics, and Javelin Strategy and Research. We  interviewed the studies’ authors and took other steps to ensure that the  data and methodologies were sufficiently reliable for our purposes. We  also spoke with representatives of the California Office of Privacy  Protection and its advisory group and reviewed the office’s recommended  practices for notification.
To address the first objective on the incidence and circumstances of data  breaches, we reviewed lists of news media-reported data breaches that are  compiled and maintained by three private research and advocacy  organizations—Privacy Rights Clearinghouse, Attrition, and the Identity  Theft Resource Center. We analyzed the three independent lists to create a  single, nonduplicative list of data breaches that had been reported in the  news media from January 2005 through December 2006. We took  measures to ensure the lists were of sufficient quality for our purposes,  including spot checking selected data and interviewing representatives of  the three organizations on their methodologies. The Privacy Rights  Clearinghouse, Attrition, and Identity Theft Resource Center lists  contained 436, 453, and 462 breaches, respectively, for the time period we  analyzed. Of the 572 breaches they collectively compiled, 59 percent  appeared on all three lists, 19 percent appeared on two, and 22 percent  appeared on one. Our analysis was based on the lists as they stood on  February 15, 2007; these data may have changed because the lists are  occasionally updated when the compilers learn of new breaches that may  have occurred in the past.
We also collected available data from federal law enforcement agencies on  the breaches they have investigated in recent years. In addition, the five  federal banking regulators provided, at our request, data on the breaches  of which they have been notified by the institutions they supervise. These  data varied in usefulness and comprehensiveness because of the  regulators’ differing methods of counting and tracking breaches and  maintaining data on them. We also gathered data from two states, New  York and North Carolina, which were selected because they were two  large states that maintain centralized information on breaches. Further, we  obtained available data from industry and trade associations representing  key sectors—such as financial services, retail sales, higher education,  hospitals, and information services—that have experienced data breaches.  We also collected information on breaches experienced by federal  agencies compiled by the House Government Reform Committee and the  U.S. Computer Emergency Readiness Team, a component of the  Department of Homeland Security.
To address the second objective, we selected for more detailed  examination the 24 largest (in terms of number of records breached) data  breaches reported in the news media from January 2000 through June  2005. We selected these breaches in August 2006 using the lists maintained  by Privacy Rights Clearinghouse and Identity Theft Resource Center, as  well as a similar compilation of breaches collected by the Congressional  Research Service. We were not aware of the Attrition list at the time we  made our selection. For each of these breaches, we reviewed news reports  as well as publicly available documents such as testimonies and criminal  indictments. We also conducted interviews, where possible, with  representatives of the entities that experienced the breach and law  enforcement agencies that investigated the breach. We identified those  cases where this information collectively indicated that the breach  appeared to have resulted in some form of identity theft. Ultimately, the  determination of whether particular conduct violated a law prohibiting  identity theft would be a matter of law for the courts. We did not directly  contact individuals whose data had been affected by the breaches because  of privacy concerns and because we did not have a systematic means of  identifying them. We also reviewed five breaches that reportedly involved  federal agencies—the Navy; the Internal Revenue Service; the Federal  Deposit Insurance Corporation; the National Park Service; and the  Department of Justice. These were selected to represent breaches that  included different causes, types of data, and involvement by third-party  vendors.
To examine the potential benefits, costs, and challenges associated with  breach notification requirements, we reviewed the federal banking  regulators’ proposed and final guidance related to breach notification, and  interviewed representatives of each agency regarding their consideration  of potential costs, benefits, and challenges during development of the  guidance. Further, we reviewed the strategic plan and other documents  issued by the President’s Identity Theft Task Force. In addition, we  conducted a review of the effects of California’s breach notification law.  We interviewed representatives of, and gathered information from, seven  organizations to learn about their experiences complying with California’s  breach notification law. These organizations were selected to represent a  range of organization sizes and industry sectors. We also interviewed  representatives of the California State Information Security Office,  California State Assembly, California Office of Privacy Protection, and  California Bankers Association.
We conducted our review from August 2006 through April 2007 in  accordance with generally accepted government auditing standards.
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Jason Bromberg, Assistant  Director; Randy Fasnacht; Marc Molino; Kathryn O’Dea; Carl Ramirez;  Linda Rego; Barbara Roesmann; and Winnie Tsen made key contributions  to this report.