Skip the navigation

The biggest data breaches of 2014 (so far)

Hackers, mistakes, bad security and stupidity are putting your data at risk like never before

By Martyn Williams
July 11, 2014 01:23 PM ET

IDG News Service - In the battle to keep your personal information private, it's not just hackers you have to worry about but lax security and stupidity.

A survey of data breaches in the first six months of this year shows an increasing number of incidents in which data, including names and addresses, credit card and Social Security numbers, and medical records was lost to criminals or exposed.

In many of the cases, the breaches were put down to poor data security practices or simple errors: like St. Vincent Breast Center in Indianapolis sending 63,000 letters containing information on upcoming appointments to the wrong people, or Stanford Federal Credit Union accidentally attaching a file with information on 18,000 customers to an email, or the thousands of paper medical records dumped at a public incineration site in York, Pennsylvania.

In other cases, laptops or thumb drives containing information were stolen -- in some cases with apparently nothing more than the login password to protect the data.

One of the biggest such cases involving laptop theft occurred at the Torrance, California, office of Sutherland Healthcare Solutions, which lost eight laptops in a February break-in. The laptops contained medical information on almost 400,000 people in California, and their theft has sparked lawsuits.

According to the Identity Theft Resource Center, there have already been 395 data breaches in the U.S. this year that have been reported to regulators or covered by media outlets, a 21 percent increase over the same period last year.

Here are the top five data breaches of the first half of 2014, with an extra entry for eBay. That breach appears to be one of the largest yet, but the exact extent of the problem has not yet been divulged by the company, so it's difficult to quantify how big it actually was.

eBay

The online retailer suffered one of the biggest data breaches yet reported by an online retailer. Attackers compromised a "small number of employee log-in credentials" between late February and early March to gain access to the company's network and, through it, compromised a database that contained customer names, encrypted passwords, email addresses, physical addresses, phone numbers and dates of birth. The breach is thought to have affected the majority of the company's 145 million members, and many were asked to change their passwords as a result.

Michaels Stores

The point-of-sale systems at 54 Michaels and Aaron Brothers stores "were attacked by criminals using highly sophisticated malware" between May 2013 and January 2014. The company said up to 2.6 million payment card numbers and expiration dates at Michaels stores and 400,000 at Aaron Brothers could have been obtained in the attack. The company received confirmation of at least some fraudulent use.

Reprinted with permission from IDG.net. Story copyright 2014 International Data Group. All rights reserved.
Our Commenting Policies