Data breaches: Blame sloppy companies, not hackers

Electronic records in the United States are streaming out of companies at a rate of 6 million a month this year, up roughly 200,000 a month from last year, according to a University of Washington researcher.

The researcher says organizations that accidentally expose their data are often to blame due to administrative errors, insider abuse, stolen equipment and the like.

Phil Howard, an assistant professor of communication at the school, has reviewed major data breaches in the United States since 1980 and says that the 2 billionth personal record will become compromised sometime this year (that's about nine records per U.S. adult). He and doctoral student Kris Erickson will publish a report on their findings in the July issue of the Journal of Computer-Mediated Communication.

The research is based on media reports of breaches and the researchers said they suspect many incidents went unreported or were underreported before a California law went into effect in 2003 that forced companies to fess up (the number of incidents confirmed tripled in 2005 and 2006 compared with the previous 24 years).

About a third of 550 breaches were attributable to malicious hacks between 1980 and 2006, whereas 60% happened as a result to organizational mismanagement, the study says. The rest were unspecified.

Universities have been hit hard by breaches, accounting for 30% of reported incidents. However, they account for less than 1% of lost records.

The researchers said they aren’t convinced that market forces, such as negative publicity generated by data breaches, will necessarily curb the problem and suspect that more states will put regulations in place. (Read about the fine art of writing a data-breach apology here.)

Some in the industry, such as Symantec, are pushing for federal regulation to address data breaches.

Check out Network World's Alpha Doggs blog for the latest in networking research at universities and other labs.