With a global pandemic, devastating wildfires, racial tension, and political divide, it is not surprising that 2020 was named the most challenging year in the past decades. The year has been grim for data privacy as well, with leaked personal data records reaching numbers the world has never seen before.
Atlas VPN analysis based on Risk Based Security data reveals that exposed data hit a record 36.1 billion in the first three quarters of 2020. The number of data records leaked this year is more than two times higher than in the entire year of 2019 and make up more than half (51%) of all exposed data in the past five years.
The first three quarters of 2020 saw a 332% increase in leaked data records compared to the same period last year when 8.35 billion records were exposed. Looking at the historical data, leaked data records surged by a whopping 1,453% from 2.33 billion through Q3 in 2016 to 36.1 billion in 2020.
A number of leaked data records already hit an all-time high in the second quarter of this year. However, the three months of Q3 brought in additional 8.43 billion records to the toll.
Let’s look at the data leak numbers quarter by quarter. From Q4 of 2019 to Q1 of 2020, leaked data numbers rose by 24%, from 6.84 billion to 8.45 billion — the most records exposed in any Q1 period over the past five years.
In Q2, the numbers of data leaked increased again, spiking by 128% to a historical high of 19.23 billion. Finally, in Q3, the number of exposed data records dropped by 56% to 8.43 billion. Nevertheless, the number is still higher than in any Q3 period since 2015.
A record-high number of data leaked this year is a result of 2,953 publicly reported data breaches. However, unlike leaked data records, data breaches dropped by 51% compared to the same period last year when 6,021 violations were reported.
The decrease in the number of breaches is caused by a general slowdown in such event reporting rather than the actual drop in breach activity. The global Covid-19 pandemic and remote work are likely to be one of the primary reasons for such a change in reporting behavior.
We can still expect to see bigger numbers by the end of this year as lagging sources reveal additional information. However, data breach levels are unlikely to reach those of 2019.
Looking at the breach data on a quarterly basis, it is evident that more frequent data breaches do not always result in a more significant amount of records leaked. Yet, breaches are growing in severity, exposing more and more records every year.
The first three months of 2020 had the most data breaches this year (1,337), which caused 8.45 billion leaked records. One breach that happened due to a misconfigured ElasticSearch cluster alone exposed 5.1 billion records. Eleven data breaches each were responsible for leaks of more than 100 million data records.
While Q2 saw the least amount of data breaches (848), these breaches resulted in the most records exposed (19.23 billion). The two largest breaches ever reported surfaced during the second quarter of 2020, accounting for more than 18 billion records put at risk.
Q3 had 768 breaches and 8.43 billion records leaked. Two breaches in the third quarter of 2020 exposed over 1 billion records each, while four breaches exposed over 100 million records per event.
The most commonly exposed data types are names (45%), emails (36%), and passwords (29%) — all the key information needed for accessing someone’s account.
Hacks are the leading cause of data breaches this year, while misconfigured databases and services are the main reason behind a staggering number of records exposed.
Creating a Secure Culture
Invest in the technology, embed the security, but don’t forget that people are your most important asset
Security. This is a word that can make a grown CFO tremble and an entire SOC crumble. It is the word that captures a complex landscape littered with complexity, cybercriminals and technology.
It defines how well an organisation adheres to a growing body of legislation – GDPR, POPIA and other data protection regulations – and how its reputation fares when a breach is revealed and information exposed. Security should be on every boardroom agenda, in ongoing employee training, and in investment into the right tools and solutions.
But, perhaps most importantly, security should be an inherent part of the company’s culture because it is this factor that ultimately determines its security risk and posture.
“There is a clear link between security culture and secure behaviour and that, in itself, correlates to a clear reduction in risk for the organisation,” says Anna Collard, SVP Content Strategy and Evangelist, KnowBe4 Africa. “By improving your security culture, you are immediately improving employee behaviour and potentially plugging one of the biggest security gaps in every business – people.
People are often the weakest link. The ones who click on the link, who open the phishing email, who share their company passwords and who accidentally create vulnerabilities within the organisation.”
A recent study undertaken by KnowBe4 examined the behaviour and security culture of more than 97, 000 employees across 1, 115 organisations worldwide. The study dug down into the components and building blocks of security culture and unpacked how this has become a critical component for any robust security structure in a detailed whitepaper.
“IT leaders have always known exactly how important people are to the perfect security triumvirate – people, process and technology,” says Collard. “But, over the years, process and technology have been pushed to the forefront of investment and conversation, leaving the human element wide open and the business at risk.
The reason for this shift is multi-fold – it’s hard to engage with a diverse workforce and the security message is not always that exciting.”
Yet, the research found a very clear proof that a robust security culture reduces the risk of credential sharing and improves the entire organisation’s security posture. In fact, it found that there was a 52x difference between the behaviours of people sharing credentials in a poor security class and the best which highlighted how a focus on security culture can significantly change the way employees adopt secure practices and behaviours.
Which again underscores the value of setting up a security culture programme that explores the seven dimensions of security culture and how these can be improved within the organisation.
These seven dimensions include: attitude, behaviour, cognition, compliance, communication, norms and responsibility. And they provide the organisation with a solid framework within which to build an equally solid security culture that has longevity and relevance.
“The more that the business focuses on security culture, the more likely it is that employees will follow secure practices and adopt more secure behaviours,” concludes Collard. “This ground breaking research has provided a very clear and measurable link between security culture and secure behaviour and emphasises the value of investing into people, training and security communication best practice to ensure that this link is always maintained.”
FirstWave, Moja Access Sign Cloud-based Cybersecurity Deal
Leading Australian-headquartered, FirstWave has announced the signing of a three-year Level 1 Partner Agreement with Moja Access, part of CSquared Group, a pan-African technology company.
FirstWave provides safety through the most accessible and adaptive cloud-based cybersecurity solutions that are affordable and easy to implement. Its unique proprietary cloudplatform orchestration is available for service providers and enterprises of any size, anywhere.
Moja Access is the Kenya-based operating company of CSquared, with a goal to make commercially driven investments to improve and increase connectivity and internet access in Sub-Saharan Africa. Internet users across the African nations can now be protected on CSquared’s network from cyber intruders, on a consumption basis, at an affordable monthly price.
In the initial phase of this partnership, FirstWave has deployed its recently launched FirstCloud WebProtect DNS platform for each of CSquared’s four territories for use by CSquared’s operating companies and Level 2 partners. The partnership builds on other recent signings opening further opportunity for FirstWave’s cybersecurity-as-a-service portfolio in Africa, first revenues to flow immediately under ‘opt-out’ path to market.
CSquared currently operates fibre and last mile WiFi networks in several cities across Kenya, Uganda, Ghana and Liberia, with over 40 mobile operators and internet service providers relying on its infrastructure for serving mobile consumers and corporate customers. These four African nations had over 10 million Micro, Small & Medium Enterprises (MSMEs) and over 70 million internet users at the end of 2020.
FirstWave’s CEO, Neil Pollock, said, “I’m delighted to welcome CSquared Group’s Moja Access as our 8th Level 1 partner and see initial revenues already flowing from the partnership. CSquared is a fast-growing pan- African service provider backed by two large global corporations Google LLC and Mitsui & Co.
CSquared already delivers robust fibre connectivity and internet access to thousands of end-customers via its 40+ mobile operator and ISP clients. With revenues already delivered, the partnership has had a really positive start.”
Npower Dumps Mobile App after Hackers Breach Customer Accounts
Npower, one the UK’s big six energy providers serving serving 3.6 million residential and business accounts, has shut down its mobile app after hackers accessed customers’ accounts, inluding partial bank details.
Npower says customer accounts were accessed using login data obtained from other websites – a common technique used by hackers, known as ‘credential stuffing’.
The firm won’t say how many accounts were hacked, though it says not all accounts were affected and customers whose accounts were accessed have now been contacted.
Data at risk includes personal information, such as dates of birth and addresses, bank sort codes and the last four digits of account numbers, and contact preferences.
An Npower spokesperson says: “We immediately locked any online accounts that were affected, blocked suspicious IP addresses and deactivated the Npower app. We’ve also notified the Information Commissioner’s Office and Action Fraud. Protecting customers’ security and data is our top priority.”
Npower says it has shut down its app in the wake of the attack and does not intend to relaunch it.
Financial1 month ago
Nigerian Telcos To Discontinue Banks’ Use of USSD Over N42 Billion Debt
Action3 weeks ago
Nigerian Court Extends NIN Registration by Two Months
Product News3 months ago
Western Digital Unveils Portable SSDs Across Portfolio
Africa Region3 months ago
MTN’s Ayoba Reassures Users on Privacy, Security of Messaging App