Organized crime behind big spike in corporate data breaches

Attacks on financial firms' networks, in particular, have become highly sophisticated and more successful, according to a Verizon study

A new study from Verizon Business claims that organized crime is responsible for a large increase in the number of breached corporate electronic records, which totaled roughly 285 million last year.

According to the study, which Verizon Business compiled using data from the 90 confirmed corporate network breaches it recorded last year, roughly 93 percent of all records breached came from the financial sector. The company also says that nine out every 10 of these breaches involved "groups identified by law enforcement as engaged in organized crime."

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

Verizon says that the 285 million electronic records breached last year were more than the total number of records breached in the past four years combined. The reason for the sharp increase is that attacks on financial firms' networks have become more sophisticated and successful, the company says. Although only 17 percent of the attacks studied by Verizon constituted "highly sophisticated" data breaches, these attacks were responsible for 95 percent of all records breached.

Verizon says that cybercriminals are targeting financial service companies' networks to get customers' personal identification number (PIN) information in order to withdraw cash directly from their accounts. Cybercriminals are also selling PIN information on the black market, the company says.

Overall, the study found that external sources were responsible for nearly three-fourths of the breached records, while internal sources accounted for 20 percent. Partner breaches, in which network security was compromised by a company's business partner, accounted for 32 percent of all breaches.

Dr. Peter Tippet, who serves as the vice president of research and intelligence for Verizon Business Security solutions, says that nearly one quarter of all the external breaches in 2008 originated from Eastern Europe, which he described as "a notorious haven" for cybercriminals.

"We have a great deal of evidence that the malicious activity from Eastern Europe is the work of organized crime," he says. "On the bright side, efforts with law enforcement led to arrests in at least 15 cases in 2008."

Verizon says that the vast majority of attacks were easily preventable and would have been avoided if "security basics had been followed." The carrier lists several recommendations to help companies avoid future data breaches, including changing user names and passwords on a regular basis; barring workers from having shared user names and passwords; regular reviews to ensure that all open user accounts are valid and properly configured; regular testing for applications to ensure they are not vulnerable to SQL injection attacks; a comprehensive patching policy; and ensuring that human resources departments carry out effective account termination procedures for workers who are no longer with the company.