What is a Data Breach? Types & Examples You Need to Know

What is a Data Breach?

Not all data breaches happen due to deliberate actions. Some are just temporary errors that can be easily fixed. Unfortunately, data breaches can have severe ramifications if sensitive information is left unprotected. Even the smallest vulnerabilities can be exploited to immense gain and wreak havoc on a database. But what is a data breach exactly?

Summary: Despite the many ways one can cause a data breach, the result is often the same. It’s an incident that leads to the theft of confidential, proprietary, or other sensitive information without authorization.

Tip: Don’t take risks with your personal data. Protect your devices with leading cybersecurity software and guard your online privacy with a top-tier VPN service.

Examples of Data Breaches

One of the most notable examples of a major data breach is the Yahoo breach that occurred between 2013 and 2014. Yahoo disclosed that during that timeframe, the email service provider reported around 3 billion records stolen containing various user credentials and information.

While that might not be too scary given how many of those emails might have been fake, data breaches at other companies aren’t easy to brush off.

Equifax, one of the major corporations in information solutions, is often privy to its user’s financial information. But in the span of three months in 2017, the company reported over 145 million records stolen.

J.P Morgan & Chase is an investment firm that also stores a lot of sensitive financial information about account owners. Yet, in 2014, the financial giant reported a massive data breach resulting in 83 million records stolen from consumers and small businesses.

Experian has a history of sensitive data breaches despite being one of the most trusted credit reporting agencies. The credit bureau that handles credit reports for millions of Americans lost 200 million records between 2007 and 2013.

Social media websites have been consistently targeted, with MySpace and LinkedIn reporting 360 million and 165 million records stolen respectively.

The National Archive and Records Administration, a government agency, reported up to 76 million stolen records in 2008.

And we can’t forget about the infamous WikiLeaks data leaks scandal or the data leak caused by former NSA analyst Edward Snowden that had severe consequences for U.S. troops serving overseas.

Data breaches come in many forms and serve various purposes, which is why preventing them is mandatory for every individual and organization.

What Can Criminals Do With Personally Identifiable Information (PII)?

Personally identifiable information can be used with or without other data to identify someone or identify as that person.

For example, data breaches often lead to identity theft. This is where criminals steal social security numbers, addresses, banking information, and other types of sensitive data.

With that knowledge, they can pose as the victim, open bank accounts in their names, run up credit, and sell their purchases for cash.

Of course, some criminals only steal the information and sell it to other interested parties over the dark web. That way, they’re much harder to track down.

While people using stolen identities eventually get caught, the person or organizations that steal the personal information in the first place are hard to identify.

Data breaches that expose classified information can be used in acts of terrorism or cyber terrorism.

Someone may attempt to breach an organization’s data to gain access to proprietary information and trade secrets.

This could give them a competitive advantage or help ruin a company’s reputation by leaking their clients’ and customers’ personal information.

Other data breaches target sensitive or private information belonging to politicians and celebrities. This could include financial data, personal emails, photos, and other files that could tarnish their public image and change people’s perceptions of them.

In other words, criminals can do a lot of damage, financial or otherwise, with the stolen information.

Perhaps even worse is that due to how data breach laws work, victims might not even get notified of a breach. Luckily, the U.S. has strict laws requiring organizations to notify the affected victims, but other countries don’t offer this courtesy.

Hence, all the more reason to be careful when trusting a website or app with personal data financial information, photos, emails, work documents, passwords, etc.

How Does a Data Breach Happen?

In general, you can break down a data breach into three stages: research, attack, and extraction.

Research

During this initial stage, the attacker will pick a target and start looking for vulnerabilities they can exploit to steal data.

Weaknesses could come in the form of software or hardware vulnerabilities and even compromised employees.

Depending on the target and the difficulty of accessing information, the research stage can take anywhere from a couple of hours to months.

But a meticulous approach can be very dangerous.

The Attack

Whether it’s a network-based or a social attack, this stage may also take a long time.

Not all people are easily fooled by phishing attempts, and not all organizations have weak links in their security protocols.

Social attacks almost always rely on a social engineering attack to gain someone’s trust and steal their login information. From there, identity thieves can access an organization’s network and copy confidential information.

Some social attacks may rely on getting the target to download malware that automatically steals information or leaves a backdoor open for the hacker to access a device at a later date.

Network-based attacks usually target the network infrastructure directly and won’t always require prior access to login credentials.

Extraction

Once a thief is inside a network, they can pretty much do whatever they want within the permissions of the obtained level of access.

In most cases, an attacker will copy sensitive files and sell them, leak documents, or blackmail a person or organization for the safe return of the files.

Data Breach Types You Need to Know

Most malicious data breaches are cyber attacks. Even if a third party attempts to access a restricted foreign network relying on user behavior and social engineering attacks, they often have to resort to other actions to get the job done.

Brute Force Attacks

A brute force attack is a difficult method for causing a data breach. However, due to the simplistic approach, it’s quite popular among less-skilled hackers.

Essentially, brute force attacks attempt to use password-generating or guessing tools to find the right match needed to enter a network.

While some brute force attacks may succeed rapidly if they have superior computing power behind them, they’re still relatively sluggish.

These attacks can be slowed down considerably if users don’t use common words, phrases, and other easy-to-guess passwords, instead opting for complex strings of characters.

Malware

Malware or malicious software is a more targeted method of causing a data breach, and it can come in many forms.

Malicious software can be anything from executable programs, viruses, worms, or lines of code that alter or corrupt other programs.

They can be created to exploit specific vulnerabilities in antivirus software, firewalls, login applications, and other entry points into a network of devices.

Once malware gets installed on a computer, network, or mobile device, it can give the attacker lots of permissions.

Depending on its design and scope, malware code can allow attackers and hackers to access a database undetected.

Other such programs can monitor user activity and send detailed information back to the thief, like keyword strokes with spyware and keyloggers.

This would easily give someone all the login credentials needed to breach a network and steal personally identifiable information, classified files, financial data, etc.

The trouble with malware is that newer and better versions of these programs come up almost as fast as security experts fix vulnerabilities.

Of course, not all protected data is targeted for financial gain. Sometimes hackers use data breaches to delete or corrupt information, rendering the compromised data unusable.

These actions can cripple organizations, stop normal business operations, or put many lives at risk if they target personal health information at a hospital, for example.

Although the healthcare industry hasn’t recorded too many security breaches, its protected information is desirable.

Phishing for Sensitive Data

A phishing attack aims to get victims to do one of two things: share personal and financial data or leave their systems vulnerable to malware code.

To do this, a hacker or hacker group will pose as trustworthy individuals, companies, service providers, and even government agencies.

Phishing can be done via email, on social media, and over the phone.

Due to people underestimating this tactic, it’s more successful than most cyber security experts would like.

Unfortunately, the human variable remains one of the weakest links in every network’s armor.

Direct Data Breaches

Criminals can steal credit card information without resorting to digital intrusion. One form of this is called credit card skimming.

This uses special devices that can be attached to ATMs and other card readers to steal credit card data when people swipe their cards.

Another data breach type that doesn’t rely on cyber attacks and hacking would be reading someone’s unattended screen or physically installing a USB drive with malware on a device connected to a restricted network.

Although the criminal still has to use digital technology to breach and extract information, the delivery method is slightly different and more direct.

Other types include gaining access to lost mobile devices or stealing personal laptops.

Steps to Prevent Data Breaches

Data breach protection shouldn’t be underestimated whether you’re an individual or an organization. You can do a couple of things to lower your exposure and prevent a security breach.

Patching Software

Digital breaches occur due to vulnerabilities that hackers can exploit with malware, SQL injections, brute force attacks, and so on.

Keeping your antivirus and firewall software consistently updated is one of the best habits you can develop.

Use Better Encryption

Your information isn’t only at risk when sitting on your computer or on a server. It’s also vulnerable when communicated from one node in the network to another and this can lead to a security breach.

Therefore, you should ensure you’re using the best encryption for your email, phone, personal and work computer, and even for regular browsing activities.

Using a virtual private network or VPN generally helps encrypt your data.

Not Using Obsolete Devices or Software

Some manufacturers discontinue support for certain phones, laptops, routers, or programs.

Using something that isn’t receiving security upgrades or that has developed vulnerabilities over time will leave you exposed to a potential security breach.

Multi-Factor Authentication Is a Must-Have

A basic keylogger can record and transmit your username and password, enabling a third party to use them to access your device, workstation, or a secure database.

But something as simple as multi-factor authentication can make it increasingly difficult for someone else to use your credentials.

That’s because multi-factor authentication requires an additional login input, usually sent via email, text, or voice call.

Alternatively, a password manager can also keep your credentials safer.

Creating More Cyber Threat Awareness

Awareness of cyber threats and breaches is mandatory for you or your employees.

People fall victim to phishing because of a general lack of education regarding cyber security breaches.

With criminals getting increasingly better at creating fake websites and passing themselves off as trustworthy, it’s more important than ever to spot a scam.

Another reason to emphasize awareness is that many people don’t believe they would make attractive targets. So, they rarely see it coming. Always keep yourself and others apprised of fraud alerts, the dangers of weak passwords and malicious code, spoofed phone numbers, etc.

Don’t Be an Easy Target

Preparedness is the name of the game, even if you can never be 100% protected against a security incident.

Granted, celebrities, financial institutions, federal employees, and high-ranking employees in business organizations are perhaps more attractive targets than your average internet user.

But you can’t underestimate a cyber criminal’s desire to steal bank details, break into cloud storage, and use your information for personal gain.

Some cyber attacks attempt to create data breaches on a massive scale and even target unsuspecting users due to them having less impressive security measures.

To avoid identity theft, losing your confidential client data, or other important information, it’s best to recognize the severe dangers of breaches. Preparing accordingly is better than simply reacting to a breach after the damage has been done.

Resources

• TrendMicro
• Kaspersky
• HubStor

Frequently Asked Questions