Average American had their personal data stolen or exposed at least four times in 2019

New study finds the average American had their personal data stolen or exposed at least four times in 2019, with social media sites like Facebook responsible for the most security breaches

  • A new survey found the average American had a data breach four times in 2019
  • The biggest category of breaches occurred with social media sites like Facebook
  • The biggest single breach of the year came from lender First American

As more aspects of everyday life move online, the risk of having one’s personal data exposed through a security breach has risen alongside.

A new survey of major data breaches in 2019 found that the average American had their personal data exposed in some form at least four times throughout the year.

That breaks down to at least one major exposure every three months, with social media sites being the most common category of sites or services that left a user’s personal information unsecured.

The average American had their personal data exposed online at least once every three months in 2019, according to a new survey of cybersecurity breaches

However, the single biggest breach event of the year happened with First American Corporation, according to the report from Interest, which left an estimated 885 million financial documents exposed in 2019.

While it’s unclear how many of the documents were accessed by outside parties, a security flaw was found in the company’s website that would let anyone look at sensitive files–including mortgage payments, wire transfers, and more–by making a minor change to the site’s URL.

Facebook was also a major source of security breaches in 2019, exposing more than 808.5 million combined user records on three separate occasions, including unguarded email addresses, phone numbers, user comments, and more.

Facebook’s biggest single breach was reported in April of 2019, leaving 540 million user records accessible in a database that was uploaded on an Amazon cloud server without a password.

A similar breach was responsible for exposing the records of more than 250 million Microsoft customers due to a database error that left information accessible to anyone who knew where to look for it.

Social media companies were the biggest single category the led to personal information being exposed, including Facebook, which had three major security breaches in 2019 leaving more than 808.5 million user records unprotected

Social media companies were the biggest single category the led to personal information being exposed, including Facebook, which had three major security breaches in 2019 leaving more than 808.5 million user records unprotected

The report distinguishes these types of breaches, in which data was left unguarded, from more active hacks in which outside actors forced their way into private databases and directly accessed user information.

That was the case with the popular online gaming company Zynga, makers of the popular Words with Friends game, which reported hackers had broken into company’s databases containing 173 million user accounts at the end of 2019.

According to Insider, ‘what makes these data breaches so scary and infuriating, is that we want and sometimes need to trust companies such as Facebook, Adobe and First American with our personal information.’

‘Personal digital hygiene would not have prevented many of these back-end data breaches but it can help minimize the impact.’

HOW DO HACKERS USE ‘SPEAR-PHISHING’ TO STEAL USERS’ PRIVATE INFORMATION?

Spear-phishing is based on the concept of ‘phishing’ – that is where hackers attempt to re-create an official looking email, social media account or website to convince people to share their login details.

Spear-phishing is a much more targeted approach that uses the same approach but with a lot more person information.

In a spear-phishing attack the hacker would scour the social media accounts, public directories, organisation websites and anywhere that contains personal information on their target.

They then craft an email designed to look like it is coming from a professional organisation the target has a link to.

When they click a link in the email it will take them to a website that looks the same as the organisation site but when they enter their username and password it just sends it to the hacker, rather than log them in.

SOURCE: Microsoft