36 billion personal records exposed by hacks in 2020 so far

The tally smashes 2019’s record, despite a decline in the number of security incidents

The number of records exposed in data breaches and leaks has surged to 36 billion so far this year, across almost 3,000 separate incidents, further extending 2020s status as the worst year on record.

Although businesses sustained an onslaught during the first two quarters of 2020, the last three months added an additional 8.3 billion exposed records to the tally, with the 36 billion total representing twice the number of records leaked throughout 2019.

Two breaches alone exposed over a billion records each, while four breaches exposed over 100 million records together, accounting for 22.3% of Q3 records exposed, according to research by Risk Based Security. The largest incident of Q3 is attributed to an open Elasticsearch server, which exposed six billion records, though the 6.4TB of data included multiple interactions with the same client, meaning roughly 700,000 individuals were affected.

“The quagmire that formed in the breach landscape this Spring has continued through the third quarter of the year,” said executive vice president at Risk Based Security, Inga Goddijn.

“Breach disclosures continue to be well below the high water mark established just last year despite other research indicating the number of attacks are on the rise. How do we square these two competing views into the digital threat landscape?”

Though the number of exposed records has risen drastically, there’s been a decline in the number of publicly disclosed breaches. For Q3 in 2019, there were 6,021 data breaches reported by this point in the year, but only 8.3 billion records were exposed.

Goddijn argues these trends could be explained by a reduced level of media coverage, although another factor is the pivot by hackers to more lucrative ransomware attacks, with companies not always having the obligation to report the incident publicly, particularly in jurisdictions outside the EU.

Indeed, ransomware has been involved in 21% of reported breaches during 2020, with 440 incidents this year including ransomware as a component. It should also be noted that rules governing when an organisation must notify authorities over a data breach are different in the US and Europe, with American businesses not bound by the strict reporting demands set out under GDPR.

The vast majority of incidents (77.5%) were attributed to ‘outside’ hackers or cyber criminals. Of the 17% that originated from within the organisation, 67% of those were deemed the result of human error, including missing devices or misconfigured databases, while 13% were regarded as malicious.

Related Resource

How to improve cyber security for remote working

13 recommendations for security from any location

How to improve cyber security for remote working - whitepaper from MimecastDownload now

Some major 2020 incidents include an attack on fitness technology app Kinomap in April, leading to the exposure of 42 million records. In March, printing company Doxzoo inadvertently exposed 343GB of data through a misconfigured AWS S3 bucket, including sensitive information relating to branches of the UK and US military.

Only last month human error was blamed for the exposure of data belonging to 18,000 Welsh residents who had tested positive for COVID-19, which was leaked for 20 hours on a public-facing server. This incident, although smaller in scale, represented a raised threat due to the sensitive nature of the data exposed.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
US government warns of increased risk of ransomware over holiday season
ransomware

US government warns of increased risk of ransomware over holiday season

24 Nov 2021
Hackers use Linux backdoor on compromised e-commerce sites with software skimmer
malware

Hackers use Linux backdoor on compromised e-commerce sites with software skimmer

19 Nov 2021
Iranian hackers ramp up attacks against IT services sector
hacking

Iranian hackers ramp up attacks against IT services sector

19 Nov 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
Re:Invent 2021: Zerto unveils its disaster recovery solution for AWS
Amazon Web Services (AWS)

Re:Invent 2021: Zerto unveils its disaster recovery solution for AWS

1 Dec 2021