Data Security Breaches: Context and Incident Summaries
Released: 2007-05-07T00:00:00

Introduction

Personal data security breaches are being reported with increasing regularity. During the past few years, there have been numerous examples of hackers breaking into corporate, government, academic, and personal computers and compromising computer systems or stealing personal data such as Social Security, bank account, credit card, and driver's license numbers, as well as medical and student records. These breaches occur not only because of illegal or fraudulent attacks by computer hackers, but often because of careless business practices, such as lost or stolen laptop computers, or the inadvertent posting of personal data on public websites. A recent infamous example occurred in May 2006, when 26.5 million veterans and their spouses were in danger of identity theft because a Veterans Affairs data analyst took home a laptop computer containing personal data (including names, Social Security numbers, and dates of birth), which was later stolen in a burglary.

Depending on the definition, the most common type of identity theft is credit card fraud, and there is evidence that the extent of credit card fraud has increased due to opportunities provided by the Internet. Although some aspects of identity theft have been known for many years, it is viewed now primarily as a product of the information age. A particular crime of identity theft may include one or all of these stages:

Stage 1: Acquisition of the identity through theft, computer hacking, fraud, trickery, force, re-directing or intercepting mail, or even by legal means (e.g., purchase information on the Internet).

Stage 2: Use of the identity for financial gain (the most common motivation) or to avoid arrest or otherwise hide one's identity from law enforcement or other authorities (such as bill collectors). Crimes in this stage may include account takeover, opening of new accounts, extensive use of debit or credit cards, sale of the identity information on the street or black market, acquisition ("breeding") of additional identity related documents such as driver's licenses, passports, visas, health cards, etc.), filing tax returns for large refunds, insurance fraud, stealing rental cars, and many more.

Stage 3: Discovery of the theft. While many misuses of credit cards are discovered quickly, the "classic" identity theft involves a long period of time to discovery, typically from six months to as long as several years. Evidence suggests that the time it takes to discovery is related to the amount of loss incurred by the victim.

Identity theft is rarely one crime, but is composed of the commission of a wide variety of other crimes, such as check and card fraud, financial crimes of various sorts, various telemarketing and Internet scams, auto theft, counterfeiting and forgery, etc.

The difficulty in studying identity theft is investigating what portion of the long list of identity theft related crimes is related to the "classic" type of identity theft that results in repeat victimization. For example, a common type of credit card fraud is to steal an individual's credit card. The offender makes a quick purchase of an expensive item then discards the card. Has the victim's identity truly been stolen? The event clearly fits within the definition above, but it is not the wholesale theft of the victim's identity. However, should the offender be working with an accomplice, the card could be turned over several times and even sold on the street. Finally, should the victim's driver's license and other identifying documents such as a health card with a Social Security number on it also be stolen, the basic elements for stealing an individual's identity are present.

A January 2007 white paper by the computer security research company McAfee Avert Labs reports a dramatic increase in global identity theft trends. One key finding was that "[p]ersonal data for tens of millions of people disappears each year. It's either been stolen or misplaced. Despite this disturbing trend, the number of complaints is surprisingly low, which leads us to believe the losses are not fully acknowledged."

A California law that requires notice of security breaches to the affected individuals is the major reason for the increased awareness of these breaches. This law, which was implemented in July 2003, was the first of its kind in the nation.

State security breach notification requires companies and other entities that have lost personal data to notify affected consumers. Thirty-five states have enacted legislation requiring companies or state agencies to disclose security breaches involving personal information. State security freeze laws allow a customer to block unauthorized third parties from obtaining one's credit report.

Statistics

Identity theft victims spend almost 300 million hours a year trying to clear their names and re-establish good credit ratings. For additional information on this topic, see CRS Report RL31919, Federal Laws Related to Identity Theft , by [author name scrubbed].

In December 2006, a senior editor for Wired New s noted a milestone: "... the total number of lost or exposed personal records since February, 2005, [has passed] the 100 million mark." The New York Times wrote an article discussing this landmark and questioned the usefulness of computing such data breaches.

[T]he bigger picture here may be that we are now slicing and dicing the niceties of data breaches against a running tally so large, that it has lost nearly any meaning at all... 'The threat of identity theft from data losses is being greatly exaggerated,' Fred H. Cate, the director of the Center for Applied Cybersecurity Research at Indiana University in Bloomington, told this newspaper not long ago. 'And that's because a lot of people have fallen into the trap of equating data loss with identity theft.' Whether or not that is true is open to debate, but what all this data loss does represent, however, is the potential for identity theft—one that will never go away. Sure, it's a game of odds. There is only so much a crook can do with a few hundred thousand names and Social Security numbers. But once they are out there, they are out there for good. Names don't change. Neither do Social Security numbers or dates of birth. And as long as it remains easy enough to fashion that trifecta into a car loan, a home, a credit card, work papers, that would seem to be a bit of a long-term problem.

The Identity Theft and Assumption Deterrence Act of 1998 established the Federal Trade Commission (FTC) as the government entity charged with developing "procedures to ... log and acknowledge the receipt of complaints by individuals," as well as educate and assist potential victims. The FTC compiles annual reports and charts of aggregated statistics on these events, but does not identify which corporations, organizations, or other entities have been victims of security breaches. In February 2007, FTC issued its annual report on fraud complaints consumers have filed with the agency. For the seventh year in a row, identity theft topped the list, accounting for 36% of the 674,354 complaints received between January 1 and December 31, 2006. Credit card fraud was the most common form of reported identity theft, followed by phone or utilities fraud, bank fraud, and employment fraud.

A number of federal agencies (e.g., the FTC, Department of Justice, Secret Service, U.S. Postal Service, and Social Security Administration), state attorneys general, and nonprofit organizations (such as the Electronic Privacy Information Center) are involved with data privacy investigations or related consumer assistance. None of them maintain a comprehensive itemized list of data security breaches. However, the Privacy Rights Clearinghouse maintains a frequently updated chronology of data breaches from February 2005 to the present.

The United States Computer Emergency Readiness Team (US-CERT) interacts with federal agencies, industry, the research community, state and local governments, and others to collect reasoned and actionable cybersecurity information and to identify emerging cybersecurity threats. US-CERT has recently begun monitoring trends involving the acquisition of personally identifiable information (PII) by unauthorized, malicious users. Based on the information reported in the first quarter of FY2007, US-CERT identified the following cybersecurity trends: phishing made up the bulk of security threats reported to US-CERT, accounting for almost 75% of all incidents handled. The number of reports grew by more than 500%, with just over 16,000 reports in FY2006 Q1, compared with over 103,000 in FY2007 Q1. The second highest category was "others," the bulk of which generally fell into two main areas: investigations, which were incidents found by US-CERT analysts combing through data, and incidents involving PII, both cyber and non-cyber in nature. The remaining 8% of incidents were spread across malware, equipment theft/loss, policy violations, and suspicious network activity.

Data Security Breaches in Federal Agencies

In reports to Congress since 1997, GAO has identified information security as a government-wide high-risk issue. In their FY2006 financial statement audit reports, 21 out of 24 agencies indicated that they had significant weaknesses in information security controls. As shown in reports by GAO and agency inspectors general (IG), the weaknesses persist in major categories of controls—including, for example, access controls, which ensure that only authorized individuals can read, alter, or delete data; and configuration management controls, which provide assurance that only authorized software programs are implemented. "Organizations can reduce the risks associated with intrusions and misuse if they take steps to detect and respond to incidents before significant damage occurs, analyze the causes and effects of incidents, and apply the lessons learned."

In February 2007, the Federal Bureau of Investigation (FBI) reported that 160 laptop computers were lost or stolen in less than four years (February 2002 to September 2005), including at least 10 that contained sensitive or classified information—one of which held "personal identifying information on FBI personnel." According to the report, the FBI failed to report 76% of the missing laptops to the Justice Department as required.

A number of data security breaches by federal agencies revealed many agencies do not have adequate security controls in place (see Table 3 , below). In 2006, the list of agencies with incidents of potentially compromised data included the Departments of Agriculture, Defense, Energy, Veterans Affairs, and Transportation, the Federal Trade Commission, the Internal Revenue Service, the Government Accountability Office, the National Institutes of Health, and the Department of the Navy. The State Department also suffered a series of hacking attacks. In FY2006, 5,146 incidents were reported to the Department of Homeland Security's incident response center for six categories of incidents, a substantial increase in the number of incidents (3,600) reported the prior year, including 706 instances of unauthorized access and 1,465 cases of malicious computer code, according to a yearly OMB report.

[E]xperts say the federal government faces special challenges because of the variety of sensitive information it keeps, the increasingly mobile nature of the federal workforce and the pervasive use of contractors, which allow thousands of individuals with varying levels of security clearance to access government databases from remote sites. A 2004 government survey on the work practices of 1.8 million federal workers found that more than 140,000 had clearance to connect with government computer systems from home. The IRS says 50,000 of its employees have laptops allowing them to access personal and business tax information from anywhere. And 133 Education Department personnel can access more than 10,000 records containing student loan recipients' personal information.

In a report released in October 2006, the House Government Reform Committee summarized information provided to the Committee by 19 federal departments and agencies regarding the loss or compromise of personal information since January 2003. The report finds that every agency has experienced at least one such breach and that the agencies do not always know what information has been lost or how many individuals could be affected.

In June, 2006, the Office of Management and Budget issued new security guidelines requiring federal civilian agencies to implement new measures to protect sensitive personal information held by federal agencies. To comply with the new policy, agencies will have to encrypt all data on laptop or handheld computers unless the data are classified as "non-sensitive" by an agency's deputy director. Agency employees also would need two-factor authentication—a password plus a physical device such as a key card—to reach a work database through a remote connection, which must be automatically severed after 30 minutes of inactivity.

The President's Identity Theft Task Force, which was established by Executive Order on May 10, 2006, is now composed of 18 federal agencies and departments. After a year of study, the Identity Theft Task Force released its final recommendations in April 2007. The recommendations include the following:

Reduce the unnecessary use of Social Security numbers by federal agencies, Establish national standards that require private sector entities to safeguard the personal data they compile and maintain and to provide notice to consumers when a breach occurs that poses a significant risk of identity theft, Implement a broad, sustained awareness campaign by federal agencies to educate consumers, the private sector, and the public sector on methods to deter, detect, and defend against identity theft, and Create a National Identity Theft Law Enforcement Center to allow law enforcement agencies to coordinate their efforts and information more efficiently, and investigate and prosecute identity thieves more effectively.

In June 2006, a group of government agencies, corporations, and universities launched a research center dedicated to the study of identity fraud. The Center for Identity Management and Information Protection is dedicated to furthering a national research agenda on identity management, information sharing, and data protection.

Congress considered legislation in the 109 th Congress to address data security following a series of high-profile data security breaches at major financial services firms and data brokers, including ChoicePoint and LexisNexis. Multiple measures were introduced in 2005 and 2006, and several were reported out of committee, but none were brought to the floor. For information on proposed data security legislation in the 110 th Congress, see CRS Report RL33273, Data Security: Federal Legislative Approaches , by [author name scrubbed].

For a discussion of legislative and other issues on this topic, see

CRS Report RS22374, Data Security: Federal and State Laws , by [author name scrubbed]; CRS Report RL33273, Data Security: Federal Legislative Approaches , by [author name scrubbed]; CRS Report RL34028, Identity Theft Laws: State Penalties and Remedies and Pending Federal Bills , by [author name scrubbed]; CRS Report RL33005, Information Brokers: Federal and State Laws , by Angie A. Welborn; CRS Report RL33612, Department of Veterans Affairs: Information Security and Information Technology Management Reorganization , by [author name scrubbed]; CRS Report RL31919, Federal Laws Related to Identity Theft , by [author name scrubbed]; and CRS Report RS22082, Identity Theft: The Internet Connection , by [author name scrubbed].

Data Security Breaches: Highlights

Tables 1 through 5 summarize selected data security or identity theft breaches reported in the press since 2000. A few highlights compiled from the report include the following.

More than half of the security breaches occurred at institutions of higher education. (A Chronicle of Higher Education article examines why this is so, noting that while colleges have become better at detecting electronic break-ins, security practices, particularly password protections, are lax. In addition, academic culture embraces the open exchange of information and provides a target-rich environment for data breaches—an abundance of computer equipment filled with sensitive data and a pool of financially naive students. ) In September 2006, Louisiana State University (LSU), under a year-long agreement with Equifax Inc., provided students, faculty and staff members with free daily monitoring of their credit reports and $2,500 in identity-theft insurance. LSU claims this is the first agreement of its kind between a credit agency and a higher-education institution. The university will pay Equifax, Inc. $150,000. Other prevalent targets for identity theft are financial institutions (banks, credit card companies, securities companies, etc.), and government agencies (international, federal, state, and local). The AARP analyzed 244 publicly disclosed security breaches from January 1, 2005 through May 26, 2006, identified by the Identity Theft Resource Center (ITRC). An examination of the most frequent cause of reported security breaches reveals that a third of all breaches were caused by hackers who broke into computer systems to gain access to sensitive personal information. The analysis finds that educational institutions are more likely than any other type of entity to report having had a security breach. In fact, educational institutions were more than twice as likely to report suffering a breach as any other type of entity. Physical theft of computers, computer equipment, or paper files is the next most common cause of security breaches, followed by improper display (allowing sensitive personal information to be viewed by those who should not have access (for example, printing of Social Security numbers on address labels, inadvertently making sensitive personal information accessible on Internet sites viewable by the general public, or not properly disposing of files containing sensitive personal information).

For Additional Reading

CRS Report RS22374, Data Security: Federal and State Laws , by [author name scrubbed].

CRS Report RL33273, Data Security: Federal Legislative Approaches , by [author name scrubbed].

CRS Report RL34028, Identity Theft Laws: State Penalties and Remedies and Pending Federal Bills , by [author name scrubbed].

CRS Report RL33005, Information Brokers: Federal and State Laws , by Angie A. Welborn.

CRS Report RL33612, Department of Veterans Affairs: Information Security and Information Technology Management Reorganization , by [author name scrubbed].

CRS Report RL31919, Federal Laws Related to Identity Theft , by [author name scrubbed].

CRS Report RS22082, Identity Theft: The Internet Connection , by [author name scrubbed].