Laurel Thomas* says most participants in a recent study had no idea that their email addresses and other personal information had been compromised, in an average of five data breaches each.
It’s been nine years since the LinkedIn data breach, eight years since Adobe customers were victims of cyber attackers and four years since Equifax made headlines for the exposure of private information of millions of people.
The number of data breaches and victims has multiplied rapidly over the past decade or so, but aside from these well-publicised cases, most participants in a recent University of Michigan study remained unaware that their email addresses and other personal information had been compromised in five data breaches on average.
In the first known study to ask participants about actual data breaches that impacted them, researchers from the U-M School of Information showed 413 people facts from up to three breaches that involved their own personal information.
The international team from U-M, George Washington University and Karlsruhe Institute of Technology found people were not aware of 74 per cent of the breaches.
“This is concerning.
“If people don’t know that their information was exposed in a breach, they cannot protect themselves properly against a breach’s implications, e.g., an increased risk of identity theft,” said Yixin Zou, U-M doctoral candidate.
The researchers also found that most of those breached blamed their own personal behaviours for the events—using the same password across multiple accounts, keeping the same email for a long time and signing up for “sketchy” accounts—with only 14 per cent attributing the problem to external factors.
“While there’s some responsibility on consumers to be careful about who they share their personal information with, the fault for breaches almost always lies with insufficient security practices by the affected company, not by the victims of the breach,” said Adam Aviv, associate professor of computer science at George Washington University.
The Have I Been Pwned database used in this study lists nearly 500 online breaches and 10 million compromised accounts over the last decade.
According to the Identity Theft Resource Center, the overall number of data breaches affecting U.S. consumers is even higher, reporting more than 1,108 breaches in the United States in 2020 alone.
Prior research asked about concerns and reactions to data breaches in general, or it relied on self-reported data to determine how a particular incident impacted people.
This study used public records in the Have I Been Pwned dataset of who was affected by breaches.
The research team gathered 792 responses involving 189 unique breaches and 66 different exposed data types.
Of the 431 participant email addresses queried, 73 per cent of participants were exposed in one or more breaches, with the highest number of 20.
Of all information that was breached, email addresses were compromised the most, followed by passwords, usernames, IP addresses and dates of birth.
Most participants expressed moderate concern and were most worried about the leak of physical addresses, passwords and phone numbers.
In response to their compromised accounts, they reported taking action or an intention to change passwords for 50 per cent of the breaches.
“It could be that some of the breached services were considered ‘not important’ because the breached account did not contain sensitive information.
“However, low concern about a breach may also be explained by people not fully considering or being aware of how leaked personal information could potentially be misused and harm them,” said Pete Mayer, postdoctoral researcher at Karlsruhe Institute of Technology.
Risks range from credential stuffing—or using a leaked email address and password to gain access to other accounts of the victim—to identity theft and fraud.
Most of the breaches never made the news, and often they involved little or no notification to those impacted.
“Today’s data breach notification requirements are insufficient,” Zou said. “Either people are not being notified by breached companies, or the notifications are crafted so poorly that people might get an email notification or letter but disregard it.
In prior work, we analysed data breach notification letters sent to consumers and found that they often require advanced reading skills and obscure risks.”
At the end of the study, researchers showed participants the full list of breaches affecting them and provided information for taking protective steps against potential risks from data breaches.
Guide to avoid data breaches
For data breach victims
- Check whether accounts were part of a breach using free services such as https://haveibeenpwned.com/ or https://monitor.firefox.com/.
- Read breach notifications carefully.
- Websites like the FTC’s https://identitytheft.gov/ can help create a recovery plan after identity theft.
- Make sure to change the password of the breached account and any others for which the same password was used. Doing this once should be enough unless there is a new breach.
- Sign up for identity monitoring services you get offered. Though not perfect, they are better than nothing.
- If you experience actual harm from a breach you may also be entitled to further support.
Reduce chance of data breaches
- Use a unique password for each online account. No one can remember dozens of these so it’s best to use a password manager to store and create strong passwords.
- Use two-factor authentication, wherever possible, that requires a code by phone in addition to a username and password in order to access an account.
- Freeze credit reports at the three major bureaus (Equifax, Experian, and TransUnion) to make it more difficult for identity thieves to cause financial harm.
- Consider using services such as Sign in with Apple to keep an email address private when creating new accounts (the service provider only sees an email address uniquely created for that account).
“The findings from this study further underline the failure and shortcomings of current data and security breach notification laws,” says Florian Schaub, assistant professor of information at the University of Michigan.
“What we find again and again in our work is that important legislation and regulation, which is meant to protect consumers, is rendered ineffective in practice by poor communication efforts by the affected companies that need to be held more accountable for securing customer data.”
The researchers point to Europe’s General Data Protection Regulation that legislates hefty fines for companies that don’t protect consumers as a means toward solving the issue.
The law led companies worldwide to retool their privacy programs and safeguards.
*Laurel Thomas is the Senior Public Relations Strategist for the University of Michigan’s Michigan News.
This article first appeared at news.umich.edu.au.
