'Hacktivists' Lead Data Breach Threats, Study Finds

A tiny but motivated band of 'hacktivists' are supplanting professional criminals as the biggest single data breach threat to large enterprises, an analysis of hundreds of confirmed incident reports has found.

On the face of it, the numbers in Verizon's 2012 Data Breach Investigations Report (which covers 2011) suggest that hacktivism is more of a nuisance than a major threat, accounting for only 3 percent of the 855 recorded attacks looked at across several countries.

But despite the modest volume of attacks, hacktivist incidents often lead to far more spectacular losses. Verizon found that from a total of 174 million records (individual database entries as well as documents) compromised in the 855 incidents, 100 million were stolen by hacktivists.

This means that hactivism is a theme in only three out of every 100 incidents, but nearly six out of ten of the actual records that are compromised. (See also "Ten Best Practices to Prevent Data and Privacy Breaches.")

For more, click the link below:


http://www.pcworld.com/article/252429/hacktivists_lead_data_breach_threats_study_finds.html#tk.nl_bdx_h_crawl

Criminals Exploit Stolen Customer Data

Excerpt from an article in The New York Times
Monday, February 20, 2012

Criminals Exploit Stolen Customer Data From Stratfor 

By SOMINI SENGUPTA

It began as a case of political hacktivism. Late last year, under the banner of the loose collective known as Anonymous, hackers broke into the systems of Stratfor Global Intelligence Service, a company that analyzes geopolitical risks worldwide. They stole the names, e-mail addresses and credit card numbers of thousands of its subscribers and posted them online for all to see.

That information apparently became lucre for criminals with commercial goals. Stratfor customers began receiving e-mails from what, at first glance, looked like Stratfor. An attached PDF file came with what looked like Stratfor letterhead. It warned of the risk of "harmful software" and asked the user to download an antivirus program by clicking on an embedded link. As it turns out, the link downloaded a piece of malicious software. It was detected by Microsoft's Malware Protection Center, which posted about it on its blog this week.

It's a classic example of what is known as social engineering -- tricking unsuspecting Internet users into downloading malware that can in turn be used to extract financial gain. The social engineering messages are often disguised as e-mails from friends and associates.