The next time you receive a data breach notice, should you care about what type of breach compromised your information? The short answer is yes.
The nature of the data breach impacts what information is compromised and to what extent. At Breach Clarity, we’re noticing shifts in how cybercriminals are targeting their breach efforts to maximize damage.
Here is important information to understand about types of data breaches and the potential consequences of each.
A “run of the mill” data breach involves the criminal infiltration of a single organization. The scope of the damage primarily impacts the immediate universe of that organization’s customers, employees and interests. These used to make up the bulk of data breach incidents, but data breach trends are moving elsewhere. (More on that below.)
Many standard data breaches are small or medium-size in terms of affected victims – but don’t be fooled. Though they often fly under the radar in terms of media coverage, these breaches can be very serious – particularly because they don’t garner much attention.
Any data breach that receives a Breach Clarity score of 6 or higher should receive immediate attention from its victims. The Breach Clarity algorithm will recommend the top 2-3 protective actions that should be taken right away, based on our assessment of the unique risks posed by the breach.
Large-scale data breaches that affect a million or more people are categorized as “megabreaches.” In these cases, cybercriminals target large entities to access large amounts of personal data in a fell swoop. By reasons of pure scale, megabreaches capture the most attention, but they are actually trending downward of late. In 2019, there were 42 megabreaches, but only 6 to-date in 2020.
Prominent examples of megabreaches include Equifax, Yahoo! and Facebook. These data breaches often make the news and many end up in class-action lawsuits. In fact, it was during his work as an expert witness in large data breach court cases that Jim Van Dyke first envisioned the application for Breach Clarity.
Our research shows the average Breach Clarity score of a megabreach is 2.2 (on a scale of 10), compared to 3.4 for breaches affecting fewer than 1 million. While they get the headlines, there often isn’t automatic cause for panic.
Breach complexes are newer on the scene and trending rapidly. In a breach complex, the target is a third-party provider that serves many other organizations. By targeting one entity, a cybercriminal can then access the records of dozens or hundreds of its clients. The initial reporting of a breach complex-type breach may not reveal the vast scope of all who are impacted. We view the start of a breach complex as “the earthquake before the tsunami.”
The recent Blackbaud data breach is a prime example of a breach complex. At current count in our database, more than 250 organizations that use Blackbaud software have been affected. What makes it so tricky and complicated is that different information is often compromised in every related breach, meaning the threats and severity of each will vary. There is no way communicate widely and uniformly about what information was exposed and the risks.
When you hear about a breach complex-type of breach – even if you have never heard of the organization – try to get a sense of the types businesses likely to be impacted. This can help you anticipate if you might be vulnerable, even if you’ve yet to receive a data breach notice. If and when you are notified, use Breach Clarity to determine the information compromised in the specific breach affecting you and what to do to protect yourself.
Just remember, regardless of the type of breach, one of the most important (and simplest!) things you can do is use Breach Clarity’s free tool to understand the risks and take action. With this, you’ve done the most critical thing in the fight against fraud – taking quick, common-sense action.