Australia leads APAC in reported data breaches – even without breach notification laws

Breach reporting legislation could trigger supply-chain reviews by revealing scores of breaches currently being swept under the rug

Australia may be relatively small by population but it has the most information-security breaches in the Asia-Pacific region, according to new research that has applied a standard metric as a way to compare the relative frequency and severity of security breaches.

The continuously-updated Breach Level Index (BLI) – which was used to characterise the threat level during the first half of this year in the newly released Breach Level Index 1H 2016 report – assigns each breach a score between 1 and 10 and as formulated by security firm Gemalto “to give a bit more of a feeling of how important a breach is, either for us as consumers or as businesses who trade with other businesses,” Gemalto ANZ regional director Graeme Pyper told CSO Australia.

The report counted 974 breach incidents during the first half of the year, accounting for over 550 million records – including 29 incidents that each involved more than 1 million records and 52 percent of incidents whose size was unknown.

These figures – which put the security industry on track to see more than 1 billion records stolen by the end of this year – represented a 15 percent increase over the second half of 2015 and a sharp increase from the results of the first half of 2015.

While the number of records breached is one metric of the severity of the cybersecurity climate, the BLI reflects the relative importance of the data that is stolen: confidential medical details, for example, would be considered more serious than simple name-and-password combinations.

On this basis, the highest-scoring breaches this year were the 40m records – including email, addresses, plain-text passwords, usernames, IP addresses and date of birth records – stolen from, which scored a BLI of 9.8; the 30m records stolen from 17 Media, with a BLI of 9.7; and the 55m-record breach of the Philippines' Commission on Elections, which scored 9.6.

Malicious outsiders were blamed for the most breaches – 69 percent of the total – well ahead of losses to accidental loss (18 percent), malicious insiders (8.5 percent), hacktivists (3 percent), and nation-state actors (1.4 percent).

The significant reduction in losses to malicious insiders – which dropped from 126 breaches involving 62.8m records in 2H2015 to just 83 breaches and 13.5m records in 1H2016 – continued a steady decline in such losses that began in Gemalto's 2H2014 survey, and may reflect steadily improving internal controls within businesses clamping down on users access to sensitive information.

Based on current trends, extrapolating the numbers to the end of the year revealed a surprise, Pyper said: “I assumed the second half of 2016 would see an increase in breaches but what I actually came up with was the fact that we would actually be about 18 percent lower in terms of the number of breaches than in 2015,” he said.

“From that I do take a bit of comfort that we are getting better at doing this – and in actually letting people know that something has happened.”

Australia, however, had a strong showing in terms of the number of breaches: while Asia-Pacific organisations reported just 8 percent of the overall breaches noted in the report, 22 of these occurred in Australia – compared with 13 in India, 7 in Japan, 7 in New Zealand, 5 in Hong Kong and South Korea, and just 1 in Singapore.

“Either we're a juicy target because we're actively doing things and have a stronger economy and are forging ahead,” Pyper speculated while noting that breaches in New Zealand are down considerably, “or we're just being a little more open about the breaches because of the privacy regulations that we have.”

Pending breach notification legislation – which has been recommended by the Office of the Australian Information Commissioner – will formalise a practice already being commendably practiced by the likes of Kmart Australia and is “clearly going to lead to a spike in terms of the number of incidents that will be reported,” Pyper said.

Some 79 percent of the incidents in the current report occurred in North America and 94 percent of those were from the USA, he noted – but this is likely to change as Australia and others follow that country's lead in mandating breach reporting. “Our model follows that in the USA,” he said, “but the difference is that they have the breach notification rules and we do not.”

Straw polls at candid customer sessions have this year shown that around half of audiences had had a breach this year, he added. “To have that kind of a high-level response did give me a feeling that there is a lot more that we should be doing as a collective to be able to protect information and to stop the bad guys getting access to it.”

The numbers are about more than just scaring IT and business executives into action, however: this approach effectively gives members of crucial supply chains a metric of information-security trustworthiness by which to evaluate their relationships.

In this way, organisations can evaluate their current or potential partners in terms of the information-security risk a relationship with them would present. This capability has become critical as supply-chain partners emerge as a significant vector for attack, with the 2013 Target breach notoriously attributed to an HVAC contractor and concerns mounting that similar vulnerabilities are rife across all industries. Such concerns recently led US authorities to begin sharing classified supply-chain threat reports with industry figures in a move that reflects today's deeply enmeshed supply chains and the risk that poor cybersecurity practices pose to critical trade networks.

Join the CSO newsletter!

Error: Please check your email address.

Tags Graeme Pyperinformation securityapacdata breachBLIAustraliaIP addressesprivacyCSO Australiacybercrime

More about ANZCSOGemaltoKmart Australia

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by David Braue

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts