Data Losses Overall Are Up, But Bank Data Breaches Are Fewer: Report

A report released by KPMG on Tuesday finds that globally, there's been a 40% increase in the number of publicly disclosed data loss incidents in the past two years. However, financial services firms have seen an 80% decrease in number of incidents in the past five years.

The overall increase is due partly to the fact that companies are getting better at identifying and reporting data breaches, says Greg Bell, global and Americas service leader for information protection at KPMG.

One reason the reporting of data breaches has increased is because of an SEC order in October 2011 that required more transparency over cyber risk and disclosure of the impact of data breaches. "That was the first time publicly traded organizations were obligated to disclose information about data breaches that did not pertain to personally identifiable information," Bell observes.

Another reason companies are more open about reporting data breaches is that the stigma has lessened. "I think everyone understands that when you have been breached or had an active penetration of your network, it's not necessarily because you did not take good care, it's just that the bad guys are moving more aggressively and effectively," he says. "That general awareness has been raised."

The third reason for the heightened data breach reporting is increased transparency and collaboration in the security community at large, Bell says.

In a bit of good news for the financial services sector, it's seen an 80% reduction in data loss by number of incidents. On the other hand, it's still the fifth worst performing sector.

The improvement is a result of effort on the industry's part, Bell says. "Financial services organizations have done a much better job at defending themselves from cyberattack; many of them are considered the most capable or highest maturity when it comes to building secure platforms and using active defense techniques to protect themselves," he says. "They have the ability to prevent most of the simple attacks and they've learned tremendously about how to have better control over their information."

He does expect to see attackers keep trying to infiltrate banks, however. "Financial services is where the money is," Bell says. "All these bad actors are in some way looking to prevent access to money or to gain money, so they're going to spend more time targeting financial services; we expect it to maintain at the forefront of the targeted attacks."

The main cause of data loss in banks is hacking — 35% of incidents in financial services in 2012 were in this category. Another 30% of incidents were caused by fraud and/or social engineering. Much smaller impacts were caused by hard copy loss or theft (8%) and human error (also 8%).

The overall nature of cyberattacks is changing, the report found. They're becoming longer term and targeted. Where cybercriminals used to launch trial balloons to test companies' security vulnerability — the online equivalent of "testing every door in a parking lot and eventually finding someone who was silly enough to leave their car unlocked," Bell observes — most cybercriminals today operate on a "target of choice" basis. "We know you've got some bit of information that we can monetize, therefore we're going to target you continually and persistently until we find a way to get access to that," Bell says.

The dynamics of cybercriminal groups has also changed. "We're now dealing with a large number of highly organized, highly hierarchical bad guys, rather than loosely affiliated groups of black hat hackers," Bell says. "The information they're targeting is fundamentally different. It used to be they were looking to monetize information like stolen IDs to create fake credit cards or infiltrate funds. Nowadays that's harder to do, thanks to regulatory reforms and scrutiny by financial services organizations, but we're seeing that focus change to intellectual property, unreleased financial information, and movements that can manipulate stock markets."