Because data breaches have become such commonplace incidents, there is concern that people have become desensitized to the potential harm they face upon receiving a notification letter from an organization informing them that sensitive information has been lost or misappropriated.
A recently published report from Javelin Strategies should be a wake up call to those people.
The Javelin report, Data Breach Notifications: Victims Face Four Times Higher Risk of Fraud, is based on multiple years of data and includes updates on 2009 data breaches, implications of changes to the legislative landscape and the technical means by which data breaches occur.
This report should also be heeded by those banks, healthcare organizations, government agencies, insurance companies and others that we entrust with our social security and checking account numbers, birthdates and mothers’ maiden names, and in some cases our personal health information.
Primary Questions
- Is there a link between data breach notification letters and identity fraud?
- Are data breach notification letters working?
- In the face of escalating data breaches, what should financial institutions and other companies do to protect brands and customer loyalty?
- How do victims respond to breach notification, and how does this impact their relationship with their financial institution?
- Are paper or electronic records most vulnerable?
- How are criminals obtaining data records?
There is now proof that data breach incidents put the affected individuals in harms way.
This report is mainly based on consumer data collected from Javelin’s annual Identity Fraud Survey. The survey is conducted each year using computer-assisted telephone interviewing (CATI) via random-digit dialing from 4,784 respondents in October 2008, 5,075 respondents in October 2007, and 5,000 respondents in October 2006. The surveys targeted respondents based on representative proportions of gender, age and income compared to the overall U.S. online population.
Some data also came from Dataloss.db.org, an open community research project that documents known and reported data loss incidents worldwide. Some data also came from the Identity Theft Resource Center, a non-profit organization that compiles information about public data breaches to help understand and prevent identity theft.
The responsibility for doing everything possible to help these people address this harm — from identifying identity fraud to cleaning up the fraud — should fall squarely on the laps of the entrusted organizations.
* * *
Stay Informed With ISR News Alerts:
* * *
Doug Pollack has 20+ years of industry experience in computing, networking, and software. He currently resides in Portland, Oregon and is Chief Marketing Officer for ID Experts, leader in data security breach prevention and remediation. His background includes over 13 years in Silicon Valley in management positions at Apple, 3Com, and a software startup that grew to $25MM and an IPO. After relocating to Oregon, Doug led marketing & business development for GemStone Systems, a Java technology company with close ties to Sun Microsystems & IBM, to an acquisition in 2000. Doug has also acted as interim CEO for two venture-backed software startups and prior to ID Experts was VP of marketing and business development for Digimarc, a $100MM publicly traded corporation (DMRC). Doug’s educational background includes a BSEE from Cornell Univerisity and an MBA from the Stanford Graduate School of Business.
ID Experts provides data breach solutions, risk assessment, forensic investigation and fully managed victim identity restoration to corporations, financial institutions, healthcare organizations and government agencies. As a leader in data breach prevention and remediation, the company has managed hundreds of data breach events, protects millions of individuals from identity theft and authored the Identity Crime Victim’s Bill of Rights. ID Experts is actively involved with industry organizations including ANSI/Identity Theft Prevention and Identity Management Standards Panel, International Association of Privacy Professionals, Internet Security Alliance, and the Santa Fe Group.
The Publisher gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com
