Less than one percent of the exposed data was encrypted.

Security firm Gemalto recently released its latest Breach Level Index (BLI), which tracks public breach incidents around the world. The newest Index tracked breach activity from January to June, 2017. Since Gemalto began tracking data breaches in 2013, more than nine billion records have been lost, stolen or compromised.

One of the most startling stats in the new report: nearly two billion records were either lost or stolen during the first six months of this year. That’s 122 records exposed in breaches around the globe every second.

Throughout the first half of the year, the Gemalto Breach Level Index (BLI) recorded 918 incidents, compared with 815 in the last six months of 2016, an increase of 13%. The 918 incidents account for 1.9 billion compromised records. Among those, 22 breaches had more than a million records compromised.

Of the 918 breaches, 801 of them occurred in the US. The UK placed a distant second with 40 incidents, and Canada came third with 26.

One of the top trends uncovered in the report was the role of poor internal security practices, such as improperly disposed of records, insecure databases or user error, which caused “accidental loss”. While outside attackers were behind the majority of breaches (74%), when it comes to the actual number of records lost, accidental loss caused a shockingly high proportion (86%). The study also underscored the continued problem of identity theft. The consequences to victims can of course be severe. According to the BLI, identity theft type breaches constituted about 74% of all incidents, a 49% increase in comparison to the last half of 2016.

Education, Healthcare Impacted Most Severely by Breaches

The BLI tracks data breaches worldwide and measures their severity based on multiple dimensions, including the type of data, the source of the breach, how the data was used and whether or not it was encrypted. It assigns a severity score to each breach, and distinguishes the less serious breaches from those that are more impactful.

The majority of the industries the Gemalto Index tracked had more than a 100% increase in the number of compromised, stolen or lost records. Education experienced one of the largest increases in breaches, up by 103%, with an increase of over 4,000% in the number of records. Healthcare had a similar amount of breaches compared to the last six months of 2016, however, the damage per breach went up - stolen, lost or compromised records increased 423%. Financial services, government, and entertainment industries were also impacted by a jump in breached records, especially entertainment breach incidents, which increased 220% in the first half of the year.

Getting Reactive About Security

"IT consultant CGI and Oxford Economics recently issued a study, using data from the Breach Level Index, and found two-thirds of firms breached had their share price negatively impacted. Out of the 65 companies evaluated, the breach cost shareholders over $52.40 billion,” said Jason Hart, Vice President and Chief Technology Officer for Data Protection at Gemalto.

“We can expect that number to grow significantly, especially as governments in the US, Europe and elsewhere enact laws to protect the privacy and data of their constituents by associating a monetary value to improperly securing data. Security is no longer a reactive measure but an expectation from companies and consumers. Partnerships between leaders such as Gemalto and GlobalSign are key to helping customers stay ahead in a new age of security challenges and threats.

Why Aren't More Companies Using Encryption?

While the BLI does not address email encryption – which is near and dear to GlobalSign -- it’s worth noting that it did, however, reveal that less than one percent of the exposed data was encrypted. I don’t know about you, but I find that statistic pretty terrifying. Lack of encryption combined with increased breaches and attack vectors can lead to a world of problems.

One of the best examples is 2014’s Sony Pictures’ megahack. Cyber thieves released details of unreleased movies, highly sensitive internal emails, and personal data -- including the social security numbers of 47,000 celebrities and employees. The attack cost Sony Pictures’ millions. The massive scale prompted us to ask the question, “Is it time for everyone to start encrypting internal communications?” I had hoped that incident, and the countless other breaches that have occurred since then, would serve as a wake-up call to ALL industries to stop overlooking email encryption, but as the Gemalto report highlights, unfortunately that doesn’t seem to be the case.

I stand by that original argument - email encryption isn’t just for regulated industries, like healthcare and finance. All companies have something to lose if a hacker were to gain access to their internal communications and it’s important to not just think about the stereotypical breach targets like personally identifiable information (PII), financial information, etc. There are countless topics that a company would probably not want released to the public - product launches and specs, customer and prospect projects, pricing updates, potential or in-process mergers or acquisitions, the list goes on.

As I’ve said before, I may be biased, but S/MIME can be a great option for protecting your internal communications. It’s fairly user-friendly (it’s natively supported by most enterprise mail clients and you can set it up so all outgoing emails are encrypted), you can integrate with Active Directory and Mobile Device Management (MDM) platforms to automate deployments and ongoing management, and it works for both desktop and mobile endpoints. Perhaps most importantly though is that your emails are protected in transit and at rest - thanks to the underlying cryptography, only the intended recipient can access the email contents no matter where the email is.

Don’t wait for your sensitive communications, no matter how you define sensitive, to be hacked and released. It’s time to start encrypting all your internal emails.  

Have questions about email encryption or S/MIME? Check out our white paper or contact us online. We’re happy to help!