22 Banking Breaches So Far in 2010

Credit EligibleAs a CUInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info

UPDATED: There have been 173 reported data breaches so far in 2010, and 34 of these involve financial services companies.

This means that in less than one quarter of the year, we already have seen more than one-third of the 62 banking-related breaches reported in all of 2009.

The numbers are slightly skewed, says Linda Foley of the Identity Theft Resource Center (ITRC), the organization that tracks data breaches, because some of the 22 incidents actually occurred in 2009 but are just now being brought to light - particularly in Maryland, where the state's attorney general's office reported a slew of 2009 incidents on March 1 of this year. "I suspect there will be more [reports] coming," Foley says, "so the trend thus far is we're finally finding out about breaches that are just coming out."

Click to Get Updates on the Latest Information Security News

Company* Title* Email* Subscription Type: HTML Text Healthcare Enews General Healthcare Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Government Enews General Government Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Banking Enews General Banking Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Credit Union Enews General Credit Union Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Need Help?

But the new year's breaches are enough to convince observers that last year's trends are continuing. "2010 could be a tough year for everyone," Foley says.

2010 Trends
If the breach trends do continue as they did in 2009, then financial service companies will continue to experience malicious hacking and insider theft. The challenge for organizations such as the ITRC is that many organizations fail to report their breaches. "The problem is: We're not trying to embarrass a company, but inform everyone of what is happening out there."

Based on what Foley says she's seen so far in 2010, much information has been lost, "so there's a real need for businesses to adopt policies to protect data."

Despite the Federal Trade Commission's work in promoting the ID Theft Red Flags Rule, Foley says many businesses still don't want to comply with the requirements. "If you don't want to protect it, then don't collect the data," she advises these organizations.

For those organizations that do buy into data protection, they must deputize their employees to take the responsibility seriously. "You should be telling your employees why it is important, so they buy into the wanting to actively protect data, and so they don't see it as another chore," Foley says.

Of the breaches reported thus far in 2010, financial services breaches add up to 11.7 percent of the 173 incidents -- the second lowest percentage on the list. The remaining incidents break down as:

Business/Retail - 44%
Medical/healthcare -- 23%;
Government/military --15 %;
Education - 7%

List of Reported Breaches
Editor's Note: The following is a list of data breaches that have affected U.S. financial institutions in 2010. The information was compiled from the 2010 Data Breach Report by the Identity Theft Resource Center (ITRC), based in San Diego, CA.

ESB Financial, Emporia State Bank
Emporia, KS
Records Taken: 3,097
Type of Breach: Exposure of data on Web
Date: April 23

Emporia State Bank officials announced that 7 years ago a data backup was sent to an unauthorized storage source. A total of 3,097 customers’ personal data could have been exposed by the backup. An outside computer specialist did not realize what had happened, and knowledge of the problem did not surface for seven years, when someone stumbled onto information and numbers during an Internet search. Bank officials say that names, addresses, account numbers and, in some cases, Social Security numbers, would have been available to someone who found them on the Internet.

PNC Bank
Pittsburgh, PA
Records Taken: Unknown
Type of Breach: Skimming
Date: April 15