With 4.1 Billion Records Exposed in Six Months, 2019 Is On Course To Be Record Year For Data Breaches

Only eight breaches were responsible for the exposure of 3.2 billion records in the first half of the year, according to new research.

• By Haley Samsel
• Aug 22, 2019

In the first six months of 2019, 4.1 billion compromised records were exposed in more than 3,800 publicly disclosed breaches, according to a new study published by Risk Based Security, a security research firm.

While security breaches have been in the headlines all year long, a large majority of the records ⁠— 3.2 billion ⁠— were revealed in just eight breaches. The largest of those breaches involved Verifications.io, a company that approves email addresses for third-party customers. That breach of nearly a billion names, email addresses and other personal information was due to an unsecured database that was openly accessible online, 24/7 Wall Street reported.

The second largest breach also involved a massive 885 million real estate transaction records, which were maintained by First American Financial. Cultura Colectiva, a Mexico-based digital media company, exposed 540 million Facebook users’ data through a misconfigured database in the third-largest leak.

Based on the number of records leaked, all three were among the top 10 breaches of all time, 24/7 Wall Street reported.

But while Risk Based Security analyzed the largest breaches, it also found that a large majority of breaches reported in early 2019 had a “moderate to low severity score,” meaning they exposed 10,000 or fewer records. As Forbes notes, this is because small businesses are often easy targets for hackers due to their lack of cybersecurity protections for their data.

“Quarter after quarter the pattern has repeated itself,” said Inga Goddijn, executive vice president at Risk Based Security. “The vast majority of incidents are attributable to malicious actors outside an organization. Unauthorized access of systems or services, skimmers and exposure of sensitive data on the Internet have been the top three breach types since January of 2018.”

The business sector was responsible for 67 percent of the reported breaches and nearly 85 percent of the exposed records, the firm found. And while only 149 of the 3,813 incidents involved misconfigured databases and services, those breaches exposed over 3.2 billion records. Indeed, just this week, a security researcher discovered that MoviePass, the movie ticket subscription service, exposed customer credit card numbers by not protecting a crucial database with a password.