Nicholas Patterson* says the recent report from the Government’s Notifiable Data Breaches scheme shows that while hackers cause most leaks, human error isn’t far behind.
Have you ever had your personal information leaked on the internet?
Maybe it was something you purchased online from a website, only to find out that the company was hacked months later?
If the answer is “yes”, you probably want to know whether the breach was reported and dealt with.
Australian organisations reported 242 data breaches between 1 April and 30 June.
There was a dramatic increase in notifications from February, when eight notifications were made, to June, when 90 notifications were made.
There are obvious reasons for this increase.
Since the Government’s Notifiable Data Breaches (NDB) scheme was introduced on 22 February, organisations are becoming more aware of cybersecurity, and the rules and regulations around handling data.
What does a data breach look like?
To give you an example of a data breach, we can look back to 2017, when almost 50,000 Australians had their sensitive information leaked online.
In this case, a private contractor incorrectly configured an Amazon cloud storage service, inadvertently causing the data to become publicly accessible.
A Polish security researcher discovered the data, which included names, passwords, identification details, phone numbers, and credit card numbers.
The NDB scheme aims to prevent breaches like this from being kept under wraps, and to allow all affected parties to learn the extent of the damage.
How many people were affected?
The recent quarterly NDB report suggests that most data breach notifications are coming from small or medium-sized organisations, with relatively few customers affected.
There were 55 notifications (23 per cent) of breaches in which 11 to 100 people were affected.
In 52 instances (21 per cent), 101 to 1,000 people were affected.
And there was just one notification that affected more than a million people.
This suggests that larger organisations are generally more adept at preventing data breaches.
What kind of data was breached?
The types of information being leaked are broken down into Tax File Number, health information, identity information, financial details, and contact information.
Results show that contact information was the most common type of data leaked, with 216 notifications reported (89 per cent).
This was followed by financial information, with 102 notifications (42 per cent); identity information (94 notifications, 39 per cent); and Tax File Numbers (47 notifications, 19 per cent).
It is worrying that financial information was leaked in 42 per cent of cases.
Any data breach is problematic, but the leak of financial data can have a dramatic impact on a victim’s life if it results in fraudulent purchases.
What is causing these data breaches?
Three main reasons were cited for data breaches in the last quarter: malicious or criminal attacks (59 per cent), human error (36 per cent), and system fault (5 per cent).
Most notifications were the direct result of cyber incidents, including phishing, malware, ransomware, brute-force attacks, compromised or stolen credentials, and hacking.
This was followed by theft of paperwork or data storage devices, and breaches caused by rogue employees and insider threats.
Human error is often regarded as the main cause of cybersecurity incidents.
But it was only the second most common cause of data breaches during the last quarter.
In 22 cases, data was sent to the wrong recipient.
When organisations unintentionally released or published information this accounted for 12 notifications.
The report includes clicking on a phishing email as human error, although this action should really be categorised as the result of a malicious attack.
Which industries were most affected?
The report lists five industry sectors: health service providers; finance and legal services; accounting and management services; education and business services; and professional services.
The healthcare industry was most affected, with 49 notifications (20 per cent), followed closely by the finance sector with 36 notifications (15 per cent).
Why these sectors?
Financial information, such as credit cards or bank details, is a key target for hackers because it can translate into real money quickly.
The health services industry is also a lucrative target for hackers who have in the past put confidential patient data up for ransom.
For example, in 2016, the Hollywood Presbyterian Medical Center paid a US$17,000 ransom in bitcoin to hackers who had taken control of its computer system.
The education sector reported 19 notifications (8 per cent).
This number is likely to grow as hackers become aware of the value of unpublished research and intellectual property.
A recent example of this was the hacking attempts of The Australian National University (ANU), where it was reported that ANU spent many months fending off attacks on its systems that were traced back to China.
Combating data breaches
The NDB scheme and reporting is an important way to shed light on the cybersecurity issues facing Australia, now and in the future.
Knowing how breaches are occurring, how often and to which sectors will allow cybersecurity professionals and researchers to tackle these issues head on.
Some breaches can be defended using technology, such as ransomware prevention tools.
But breaches that result from human error are more difficult.
Education and training for employees can assist them in preventing simple mishaps from occurring.
Bringing these numbers down will require a mix of technological solutions and education.
Until we get this right, we’re likely to see more breaches in the near future, rather than fewer.
* Nicholas Patterson is a lecturer in cybersecurity, algorithms and robotics at Deakin University.
This article first appeared at theconversation.com.
