Data Breach Known Records Disclosed Passes 1 Billion Mark

 I've been working on updating The Leaking Vault data breach database.  I won't be freezing the database until after June 2012, since it takes a good six months for the flow of incidents for the past year to slow to a trickle.  However, I thought I'd share some of the numbers as they currently stand. 

First, there have been a significant number of data breach incidents coming to light from prior years.  Here is the new breakdown of incidents per year.

With the new data, there are now more than 5,500 incidents, and new breaches seem to occur on a daily basis.  As you can see, 2011 already has 871 incidents, and if you are familiar with the previous two Leaking Vault reports, you will notice significant increases in both 2007 and 2008's totals. 

Even with a total of 944 incidents for 2010, however, it still remains the lowest year since the study began for known records disclosed.   Although 2007 and 2008 grew the most in terms of additional incidents being disclosed, 2008 showed the highest number of additional records, with almost 95 million.  Though 2011 is not the highest in terms of incidents, it is now the leader for records disclosed thus far. 

All told, the database shows 1.29 billion records disclosed over the past 7 years, and this total will only grow as more incidents for 2011 come in.  As pointed out in the reports, these records lost figures are an under estimation due to the fact that 36% of the incidents do not list a finite number of records disclosed for the data breach.   One partial explanation for 2010's low records disclosed number is the potential for large breaches to be concealed within the 37% "unknown" value for the records disclosed--only 1% higher than average.  However, it may simply be that there were no really large incidents during that year.  In contrast, 2009 had a 46% unreported figure for records disclosed, and it did not show a large decrease. 

I will be performing the usual analysis when I freeze the database, and releasing The Leaking Vault 2012 some time in the third quarter.  In the meantime, I'm looking at gathering some new metrics and revisiting the existing records.