2007 News Release
Data Breach Harm Analysis from ID Analytics Uncovers New Patterns of Misuse Arising from Breaches of Identity Data
Pioneering Study Spans More Than a Dozen Data Breaches of Over Ten Million Identities
SAN DIEGO, CA, November 7, 2007 — ID Analytics, Inc., the leader in Identity Risk Management, today announced the results of a new study on the harm resulting from data breaches. The study analyzed more than ten million identities spanning over a dozen data breaches. ID Analytics found five separate cases where breached identity data was misused by fraudsters, with two of those cases resulting from employee theft of data.
Key findings from ID Analytics' research include the following:
- Smaller breaches had a higher misuse rate than larger breaches. Misuse of personal data ranged from one in 200 identities for breaches of fewer than 5,000 individuals to a misuse rate of less than one in 10,000 identities for breaches of more than 100,000 individuals.
- Fraudsters engaged in organized misuse of breached identity data tended to cycle through the data quickly. Fraudsters would misuse a breached identity for no more than two weeks before moving onto the next identity.
- The study found no evidence that fraudsters misusing breach data were selling the data broadly or distributing it over the Internet. This finding is significant because one of the greatest potential risks of data breaches is the broad dissemination of personal information to others with criminal intent.
- Fraudsters tended to link the breached personal data to a limited set of new phone numbers or addresses, meaning they worked to associate these identities with particular phone numbers for verification purposes and with addresses where they could receive credit cards, wireless phones or other merchandise ordered using the breached identity data.
"In the two years since we conducted our previous National Data Breach Analysis study, concerns about data breaches have remained high," said Thomas Oscherwitz, ID Analytics' chief privacy officer and vice president of government affairs. "This new research shows the latest trends about the harm resulting from data breaches and how criminals are actually using the data. Our intention is to help organizations understand which types of data breaches pose the greatest risk, and how to best respond."
Insight into Internal Data Breaches
In two of the five cases of organized misuse, the breach perpetrator was an employee who stole data. In both cases, the resulting misuse was linked to identities geographically close to the site of the employee theft. These findings show new insights into the workings of internal data theft, particularly how fraudsters may favor those identities that represent easier access to physical addresses where the perpetrator could receive or intercept credit cards, stolen goods and bank statements.
Methodology
By analyzing data from its proprietary ID Network®, the nation's only real time, cross-industry compilation of identity information, ID Analytics is able to gain a quantitative understanding of the nature of identity fraud. The ID Network comprises three billion identity elements—including names, addresses, Social Security numbers and phone numbers—which are contributed by organizations spanning multiple industries for the purpose of preventing identity fraud. For this research, ID Analytics analyzed over a dozen breached files for suspicious activity indicative of identity fraud.
Webinar and White Paper on Findings
Today at 11:00 am PT / 2:00 pm ET, Thomas Oscherwitz will present these findings in a free, live, one-hour webinar. To request a white paper with more detailed findings on the research, email marketinginfo@idanalytics.com.
About ID Analytics, Inc.
ID Analytics, Inc., the Identity Risk Management company, owns and operates the ID Network®, the nation's only real time, cross-industry source for indentity information. ID Analytics' clients, which are also ID Network Members, span the financial services, telecommunications, e-commerce, healthcare, utility, retail, government, and consumer sectors. With an exclusive focus on stopping identity fraud, ID Analytics has built proprietary pattern recognition technology within the ID Network to find suspicious behavior patterns across multiple organizations and industries. As a result, ID Network Members lead their industries in preventing identity fraud, protecting consumers, and improving the consumer experience. ID Analytics is host of Identity 2007, the sixth annual Identity Risk Management conference Sept. 17-20. With headquarters in San Diego, Calif., ID Analytics has offices in the US and UK.
ID Analytics and ID Network are registered trademarks of ID Analytics, Inc. All other trademarks are the property of their respective holders.
