Cybercrime , Fraud Management & Cybercrime , Ransomware

Ransomware, Vendor Hacks Push Breach Number to Record High

Report: 2.6 Billion Personal Records Exposed in the Last 2 Years
Ransomware, Vendor Hacks Push Breach Number to Record High
Data breaches in the U.S. have hit an all-time high thanks to hacking incidents, including ransomware and vendor attacks, says a new study released by Apple and MIT. (Image: Getty)

The number of data breaches in the U.S. has hit an all-time high amid mounting attacks against third party vendors and aggressive ransomware attacks, says a report from Apple and a Massachusetts Institute of Technology researcher.

See Also: Webinar | Everything You Can Do to Fight Social Engineering and Phishing

Data breaches have more than tripled between 2013 and 2022, compromising 2.6 billion personal records in just the past two years - and that trend has continued to worsen in 2023, says the report written by MIT professor Stuart Madnick and published Thursday.

In the first eight months of 2023, more than 360 million people were affected by corporate and institutional data breaches, and 1 in 4 people in the U.S. had their health data exposed in data breaches.

More ransomware attacks were reported through January to September 2023 than in all of 2022, the report said. In the first three quarters of 2023, the number of ransomware attacks increased by nearly 70% compared to the same period in 2022.

A 2023 survey of 233 IT and cybersecurity professionals across 14 countries working in the healthcare sector found that 60% of organizations have faced a ransomware attack, which is almost double the 34% reported by the sector in 2021.

The largest health data breach so far this year was an email hacking incident reported by HCA Healthcare, affecting 11 million people.

Breaches have also affected millions of individuals in other economic sectors this year. That especially includes incidents involving third-party vendors, such as exploitation of vulnerabilities in Progress Software's MOVEit and Fortra's GoAnywhere file transfer applications.

"Vendor exploitation attacks often have broad ripple effects. As the initial attack allows hackers to gain access to the vendor's system and data, it may also allow hackers to access the systems and data of that vendor's clients," the report says (see: Known MOVEit Attack Victim Count Reaches 2,618 Organizations).

This is precisely what happened with the campaign targeting flaws in MOVEit and in GoAnywhere. "In both cases, an unpatched vulnerability allowed hackers to compromise the data of organizations that relied on those two vendors and steal sensitive information from their customers" (see: Clop GoAnywhere Attacks Have Now Hit 130 Organizations).

The study said that about 98% of organizations reported having a relationship with a vendor that had experienced a data breach within the last two years.

"Given the prevalence of data breaches and their real-life consequences for individuals, keeping personal data safe should be at the forefront of organizations' priorities," the report says.

About the Author

Marianne Kolbasuk McGee

Marianne Kolbasuk McGee

Executive Editor, HealthcareInfoSecurity, ISMG

McGee is executive editor of Information Security Media Group's media site. She has about 30 years of IT journalism experience, with a focus on healthcare information technology issues for more than 15 years. Before joining ISMG in 2012, she was a reporter at InformationWeek magazine and news site and played a lead role in the launch of InformationWeek's healthcare IT media site.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing, you agree to our use of cookies.