By Daniel Korsunsky
Data breaches are becoming the norm, rather than the exception, with one study finding that 70% of businesses experienced a breach in the past year. Whereas organized criminals once operated in the realm of the physical world, today they are more likely to strike via the Internet. And they have a very strong incentive to do so. Stolen credit card numbers can fetch anywhere between a few dollars to hundreds of dollars per record on the black market, depending on the FICO score of the credit card holder and their credit limit. Healthcare records garner at an even greater premium, often going for 10 to 20 times the price of a stolen credit card number. For these reasons, most enterprises have adopted an “assume breach” stance, where they expect to have been breached or will be breached in the near future. They’re also increasingly looking to proactively establish an incident response plan for what to do when they discover the inevitable breach. That’s because of painful lessons that have been learned from companies that failed to prepare for a breach and were left scrambling to mount an effective incident response once they were hit with a cyber attack.
We’ve distilled down the three worst examples of an incident response. These are cautionary tales, and every organization has something to learn from them. The common theme across all of them is that in each case, the organization was woefully ill-prepared for the breach, and their response to it was almost as damaging as the breach itself.
Target Breach (2013)
December 15, 2013, started out as a normal Sunday for then Target Chairman and CEO Gregg Steinhafel… until it wasn’t. Describing later in an interview the moment he heard news of the breach, he said “my heart sunk.” Things only got worse from there. Despite the fact that Target’s intrusion detection system had thrown up an alert when the breach initially took place in early December, the alert was ignored by Target’s cybersecurity team due to the large number of false alerts they were receiving on a regular basis. Target then allowed the hackers a full two weeks to swipe as many credit card numbers as possible. In the end, it wasn’t Target that detected the breach, but rather Brian Krebs, who noticed a large collection of credit card numbers up for sale on the Dark Web that had one thing in common: they had all made a purchase at Target recently. When the news of the breach broke, Target customers heard about it from media outlets rather than Target itself. Target further worsened the situation when it failed to share the stolen card numbers with issuing banks, thereby allowing scammers to continue to make fraudulent charges. Some banks were forced to buy back stolen card numbers on Dark Web marketplaces themselves to limit the damage. When customers tried to reach Target on the customer service line, they often faced jammed lines and, in some cases, were not able to reach a representative for days. What’s clear following this incident response is that organizations need to prepare an internal process and response team to handle incidents so they can quickly deal with customer communications and work with business partners to limit the damage.
Anthem Breach (2015)
Anthem didn’t know its systems were breached until two months after the fact, which resulted in losing personally identifiable information (PII) of its current and former customers, including their names, birth dates, Social Security numbers, medical ID numbers, as well as their income information. In all, nearly 80 million individuals had their information compromised, double their initial estimate of 37.5 million. Anthem’s slow response prompted leaders of a U.S. Senate committee on health to step in, stating in a letter, “the vast majority [of affected individuals] have not yet been informed… this delay is unacceptable and should be corrected immediately.” There were still 50 million people who hadn’t been informed of the breach more than a month after Anthem discovered it. A key lesson is the importance of customer notifications and crisis communications to handle follow up with government officials.
The Office of Personnel Management Breach (2015)
In June of 2015, the United States Office of Personnel Management (OPM) announced that its databases had been breached and personal information of 21 million government employees had been stolen. The compromised information included information found on job applications including Social Security numbers, as well as background checks that revealed employment history, relatives, addresses, and past drug use. The files also contained fingerprints for 1.1 million people.
It took the OPM over a year to detect the breach, giving the hackers ample time to scour the OPM database for some of the most sensitive information on federal employees. OPM was ill-prepared for the hack and suffered from outdated security infrastructure and configuration. However, unlike the other examples on this list, the OPM continued to face criticism in not upgrading their security infrastructure to prevent future hacks. An internal audit showed that the system upgrades that allowed the OPM to detect the breach itself is vulnerable. OPM also showed poor planning in upgrading their systems. Audits showed that they vastly underestimated the cost of the upgrades and would likely face budget shortfalls that would delay needed upgrades. As recently as last month, the office of the agency’s inspector general report stated, “We continue to believe that there is a very high risk that the project will fail to meet its stated objectives of delivering a more secure environment at a lower cost.”
