Verizon: Organized crime fuels spike in data breaches

Cybercrime is rising sharply and being dominated by organized crime figures who are targeting specific businesses, many within the financial services sector, according to the 2009 Verizon Business Data Breach Investigations Report (DBIR). This second annual report showed more electronic records were breached in 2008 than in 2004 to 2007 combined, said Wade Baker, research and intelligence principal at Verizon Business. The report also showed 90% of attacks can be avoided by following basic security procedures.

Verizon investigated known data breaches to determine who is mounting the attacks, how they happened, how many data records were compromised and how they could be prevented. The 2009 DBIR looked at 90 confirmed data breaches and found 285 million records had been compromised as a result of those breaches, compared to 230 million in all the data breaches of the previous four years, Baker said. Ninety percent of attacks involved groups identified by law enforcement as being part of organized crime.

"We saw a rise in targeted attacks where criminals singled out a company and created an elaborate scheme to steal data from that company," Baker said. "We saw targets selected, and not just because they were easy targets but because of the data they had. These companies were pre-identified, the criminals worked hard to breach their systems and were well paid for it."

Most of these targets were companies that processed or stored data that can be "easily convertible to cash for criminal purposes" such as credit card numbers or Social Security numbers, Baker said. Ninety-three percent of victim companies were in the financial services industry. In the past, many of the cyber attacks were lodged against "low-hanging fruit," or companies that left themselves obviously vulnerable, Baker said. That's no longer the case.

Attacks more sophisticated

With organized crime moving in, attacks have also become more sophisticated, Baker added, particularly those that target specific companies. "We're finding attacks involving malware that was customized in some way were more than double," he said. "It speaks to the fact they have targeted a company and have a specific purpose in mind, so they create this malicious software to carry out that purpose."

The DIBR showed some growing concerns may be unwarranted. While the increase in mobility for laptops, smartphones and other data devices has enterprise security officials concerned, the Verizon Business report showed 99% of all attacks are lodged against a central repository of data, Baker said. In addition, 80% of all attacks are by outside sources, not internal ones.