Data Breaches & Identity Theft: What You Need to Know

Data breach: A data breach is any security incident in which unauthorized parties access sensitive or confidential information, including personal data (Social Security numbers, bank account numbers, healthcare data) or corporate data (customer data records, intellectual property, financial information).

There is no shortage of stories in the news right now about data breaches.? AT&T just announced that 51 million customers have been affected by a past data breach.? UnitedHealth Group’s, Change Healthcare, has had more than 6 terabytes of data compromised.? LoanDepot’s breach has affected over 16 million individuals.? As of today’s writing, April 12, 2024, over 875 million records have been breached in the USA so far in 2024 alone.? This information comes from 1,819 publicly disclosed breaches.? That’s an average of 218 million records and 455 companies per month! [i]

The types of data that have been compromised in these breaches can include:

?

·?????????????? First name

·?????????????? Last name

·?????????????? Date of birth

·?????????????? Phone number

·?????????????? Address

·?????????????? SSN

·?????????????? Driver license number

·?????????????? Mother's maiden name

·?????????????? Credit card numbers

·?????????????? Loan numbers

·?????????????? Bank name

·?????????????? Bank account number

·?????????????? Usernames

·?????????????? Passwords

·?????????????? Email addresses

·?????????????? Social media accounts

·?????????????? Medical record numbers

·?????????????? Medical plan information

·?????????????? Medical diagnosis

·?????????????? And so much more!

Once this data is stolen, it is often sold to the highest bidder on dark web marketplaces, where the buyer can do what they want with it.? In some cases, hackers have reached out directly to consumers to extort them, promising to protect their data before leaking or auctioning.? An example of this was a plastic surgeon in Pennsylvania.? This organization specializes in breast augmentation surgery.? Data stolen included before and after photos of the patient.? The hackers were “ensuring” patients, for $50, they would exclude their patient data in their leak.?

Data theft is very damaging for all parties involved.? The company that suffers the breach often faces the loss of intellectual property, competitive edge, downtime, lawsuits, regulatory fines, and other negative financially impacting situations.? The customers face the potential of private and embarrassing data being leaked, credit cards or loans attempted to be opened in their names, and medical bills for services they didn’t receive, just to name a few.

Identity Theft: The?fraudulent?acquisition and use of a person's private identifying information, usually for financial gain.

????????????????? Stealing someone’s identity is no longer the dirty work of sifting through trash cans and dumpsters in the hope of finding bank accounts or credit card statements.? Unfortunately, a large amount of data is now readily available from the convenience of sitting behind a keyboard.? Just think about the 875 million records mentioned above.? Those records are available, sometimes publicly, to anyone who has the time and ambition to look for it. (By the way, it’s not that hard.)

Below are the most common types of identity theft you should be educated on:[i]

·????? Financial Identity Theft – when someone uses your identity or information to obtain credit, goods, services, or benefits.? This is the most common form of identity theft.

·????? Social Security Identity Theft – though like financial identity theft, fraudsters will use your SSN to apply for credit cards and loans and then not pay any balances.? You might not even know these accounts exist until they get sent to collections.? They can also use your social security information to receive medical, disability, and other benefits.

·????? Medical Identity Theft – this is when someone has enough personal information about you to pose themselves as you and obtain free medical care.

·????? Synthetic Identity Theft - this is when a fraudster uses a combo of real data (usually stolen) and fake information to create a whole new identity.? What’s the purpose of a fake identity?? It allows them to open fraudulent accounts, make fraudulent purchases, and steal money from financial institutions while not being accountable for any of it.

·????? Child Identity Theft – it’s possible that if your child’s name and SSN are compromised someone may use it to gain residence, find employment, obtain loans, or avoid arrest on outstanding warrants.?

You might be thinking now, how can I fight back?? Though this isn’t meant to be an exhaustive guide, consider the following bullets and educate yourself on each of them.

·????? Get a password manager and change your passwords.? Password managers allow you to create obscure passwords that are saved to a vault.? You only must remember one password to get into said vault.

·????? Turn on multifactor authentication anywhere and everywhere possible.? This includes your bank accounts, credit card accounts, cell phone accounts, social media accounts, etc.? Anywhere that supports it, TURN IT ON!

·????? Freeze your credit and set up fraud alerts.? This is free to do!? You must create an account with all 3 credit bureaus (TransUnion, Experian, and Equifax).? If you aren’t planning to apply for credit or loans, freeze it!? It might stop someone from doing it on your behalf.

·????? Monitor your accounts.? It is so easy to live on autopilot.? Check your bank statements, credit statements, and even medical statements.? Sometimes people make mistakes and sometimes it's bad people trying to make your life a nightmare.

·????? Consider Identity theft protection services.? If you have gotten a letter from XYZ company about your data being involved in a breach and they are offering identity theft protection, don’t wait, sign up!? Even if you haven’t got a letter, consider these services.? Also, check with your homeowner’s insurance provider, some carriers are now offering cyber insurance to the consumer directly.

Identity theft is a real threat to everyone.? Even more, as more and more companies are experiencing data breaches.? There is a good chance that in some corner of the web, your personal information exists to some extent.? Are you going to protect it?

[i] Data Breaches and Cyber Attacks in 2024 in the USA

https://www.itgovernanceusa.com/blog/data-breaches-and-cyber-attacks-in-2024-in-the-usa

[i] What is Identity Theft and Examples

https://www.investopedia.com/terms/i/identitytheft.asp

Written By : Aaron Gurgul, CISO, Watchdog Cyber?

?

?