Five data leak nightmares

Data breaches cost companies an average of $197 per record in 2007, according to a study by the Ponemon Institute. The average cost of a data breach was $6.3 million, up from $4.8 million in 2006.

And that just covers direct costs. A well-publicized data breach can also translate into lost business opportunity to the tune of $128 per leaked customer record, according to the Ponemon study. No wonder companies are rushing to shore up their defenses against data leakage.

In this package of stories, we will describe the five worst data leak nightmares, chronicle the rapid consolidation in the data leak market, profile five key data leak companies and interview a leading expert in data loss prevention.

Nightmare 1:
Film at 11
A high-profile data breach can cost your company millions. Just ask TJX.

When The Home Depot lost a laptop containing personal information on 10,000 employees, it was just the latest in a string of high-profile data-leak incidents. The Veterans Administration, TJX, Monster.com, Fidelity National Information Services, Pfizer, AOL, Ameritrade – the list goes on and on.

This nightmare gets much worse if you are at fault and not simply a victim of hackers. Consider one of the most publicized data-leak victims: TJX. The attack was certainly the fault of hackers, but according to Carol Baroudi, research director, security technologies for Aberdeen Group, TJX must shoulder some responsibility.

“TJX should never have stored magnetic stripe information in their databases,” Baroudi says. “It was a flawed storage policy. They didn’t even realize they were putting personal information at risk.”

Worse still, TJX didn’t discover the breach. Visa did. The TJX breach has gone from a bad dream to a recurring nightmare, with the company hit by lawsuit after lawsuit, the latest one being an October court filing by credit card companies alleging that the breach hit 94 million credit cards, twice as many as TJX has acknowledged.

Another example is AOL. The AOL data leak wasn’t the result of bad policy, but rather of good (albeit misguided) intentions. At the time of the leak, AOL had a nascent research site to which it posted users’ search histories to spur further research. This move inadvertently exposed the Web surfing habits of many users.

Yes, AOL kept its users’ identities secret, but anyone who bothered to dig into the nitty-gritty details of those searches could figure out who was browsing for what, since people often search for themselves, close friends, their hobbies, organizations they belong to, and businesses near them.

AOL employees didn’t intend to harm the organization, but these unintentional incidents can be just as bad – if not worse – as malicious ones.