Valuing A Data Breach Victim

[Inga Goddijn <inga () riskbasedsecurity com>]

http://techcrunch.com/2015/10/25/valuing-a-data-breach-victim/

In the relentless world of public breach reporting, there’s a fixation on
the number of accounts affected; the higher the number, the larger the
impact. But from a victim’s perspective, does it make a difference if your
information was included in a breach alongside 10,000 or 50,000,000 others?

> From a criminal ecosystem perspective, the number of victims per successful
breach is largely irrelevant. Apart from the original hackers, where
obtaining a million records is more efficient than just a thousand and,
consequently, where basic multipliers are at play, the rest of the
cybercrime world is oriented toward timeliness and completeness of the
stolen data.

Depending upon which underground hacking site, dark web portal, data
trading site or rock you turn over, the price per stolen record will vary
considerably — ranging from $0.0001 through to $200. Stolen data value
depreciates rapidly for most classes of personal information. For example,
the value of credit card records (which would include the victim’s name,
address, credit card number, expiry data and CCV) deteriorates by orders of
magnitude once the breach is publicly reported, as the credit companies
have added the cards to their fraud detection systems and banks may have
already canceled many of them.

Within the ecosystem there exists a broad spectrum of criminal services
designed to manage, verify, distribute and launder the stolen data. For
example, there are moderators and facilitators that charge up to 25 percent
in fees for aiding the transfer of data between buyers and sellers —
complete with star-rating systems and testimonials. Meanwhile there are
services that process tens-of-millions of stolen credit card details each
week in order to verify whether each card is still “live” and to determine
the credit limit of the account.

A lot of public breaches result in the theft of users’ names, email
addresses and their associated passwords. Luckily, those passwords are
often encrypted; however, all-too-often the keys (or salts) are also
obtained during the breach. For the majority of cybercriminals, this kind
of data is practically worthless; any value that can be extracted will be
dependent upon the original hackers decrypting the passwords before
they look for a buyer — which can take considerable time and resources (but
is not uncommon). Even then, the accounts and passwords would only fetch
minimum values in bulk packages. For example, a breach of a million records
may contain 250,000 victims that registered with a Gmail email address.

That bundle of 250,000 records (user name, email address, decrypted
password) may be purchased for as little as $20 — and the purchaser would
likely then use the list to try brute-forcing other sites (including Gmail)
in the hope that the victims had reused the same password. The price (and
value) of the stolen data bundle drops rapidly every hour and every time it
is sold (by the hackers, or resold by the purchasers). Once the list of
stolen credentials are made public (for example, posted on a pastebin site
or acknowledged in a security blog), the data becomes worthless — except to
perhaps security researchers.

Stolen credit card details tend to get the most attention in the media, but
the reality of the situation is that banks and credit companies have become
very efficient at responding to breaches and have invested heavily in
automated fraud detection systems in the U.S. The probability of a breach
victim’s stolen credit card details actually resulting in a personal
financial loss is practically negligible.

With widespread adoption of chip technology in credit and debit cards
within the U.S. (from October 2015), the prospect of counterfeit card
cloning and in-store fraud will drop further — and the value of stolen
credit card details will continue to fall further for the hackers behind
the breaches. Some people have questioned whether the U.S. strategy of
chip-and-signature versus the European chip-and-PIN is a better defense
against fraud (Brian Krebs has a very good blog on the pros and cons
<http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/>).

If stolen email addresses, passwords and even credit card details aren’t
the big money earners for the hackers behind the breaches, what data
targets are worth the effort?

The more exhaustive the data record, the more uses it has, and consequently
the greater the value to the cybercriminal ecosystem. For example, a single
record containing the victim’s full name, address, date of birth, social
security number, driver’s license number, photo ID (e.g. scan of passport
page or driver’s license) and bank account number can be worth as much as
$100 — depending upon the country and nationality of the victim.

While many people may assume that such data would be used by a criminal to
remove money from the victim’s bank account (which may be the case if the
criminal can uncover a valid online password for the account), it is more
probable that those data will be used to create multiple new bank accounts
(for the purpose of laundering monies of other international criminal
enterprises) or obtaining new credit cards and loans (for the purpose of
quick cash).

Whether it’s a mega breach of a retail hardware store or only a hundred
records from a florist’s website, it’s not the quantity of records that
really matter to the victims — it’s the type, completeness and timeliness
of the records that really matter. As a victim of a data breach, it’s
important to understand what data has actually been stolen. Data that can’t
easily be modified or canceled is what will hurt the most and hurt the
longest and, because of its value, will increasingly be targeted by
criminals.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!