Back in April, this blog discussed the release of the 2011 Data Breach Notification Report (Adobe PDF) by the Massachusetts Office of Consumer Affairs and Business Regulation (OCABR). Since then, I further analyzed some of the results from the report. New charts are below.
You may remember that the report covered data breach activity since October 31, 2007, when the state's breach law went into effect. The 2007 law requires businesses that store consumers sensitive personal information to notify the OCABR if they experience or suspect a data breach. In 2009, the state enacted tougher data security rules. In March 2010, the law was amended to require applicable businesses to develop a comprehensive, written information security program and to encrypt certain data.
Some highlights from the report:
- 1,833 data breaches and 3,166,031 Massachusetts residents affected since November 1, 2007
- Notable data breaches during 2011: Sony Playstation, Michael's craft stores, Departments of Unemployment Assistance and Career Services
- Industries with the most data breaches include financial service, health care, education, and state government
- While the number of breaches are evenly split between malicious and non-malicious categories, on average malicious data breaches affect a larger number of residents with each breach compared to non-malicious breaches
- On average, breaches where information is stored in electronic formats are substantially larger than breaches where information is stored in paper format
Breach history (number of data breaches):
|Year||Malicious Breaches||Non-Malicious Breaches||Total Breaches|
|#||% of Total||% Of Total
|The non-malicious category includes breaches where, "... either negligence or mistakes by employees or third-party contracgtors resulted in exposing personal information..."|
The malicious category includes breaches:
"... made by disgruntled former employees of businesses which held personal information who either retained access to data, or used the access codes of a former coworker to gain access."
The average number of residents affected per data breach:
|Year||Malicious Breaches||Non-Malicious Breaches||Total Average Residents/Breach|
Breach activity based on the storage format of the information:
||Residents / Breach||# Breaches
||Residents / Breach|
The number of breaches by industry:
|Industry||Breaches: 2011||Breaches: 2007 - 2011|
|Food & Beverage||5||35|