Data Breach by Industry
In 2023, 3,205 data breaches occurred in the United States, impacting over 353 million people, according to Statista. They occurred across public and private industries at the hands of insiders and external bad actors. IBM reports that a single data breach costs a business an average of $4.45 million. Security technology has become more important than ever because no industry is exempt.
- Medical records are extremely valuable to thieves, selling for much more than stolen credit card numbers. This shows why health care is often targeted for data theft.
- Banks and financial companies are also major targets for hackers, with each breach costing nearly $6 million on average. The attackers are often after money, but sometimes they aim to disrupt economies or make political statements.
- Data breaches are not just a problem for businesses; government offices, the DMV, and schools also get hit, leading to big issues like the exposure of personal and sensitive information of millions of people.
- Hotels, restaurants, and manufacturing companies face serious threats from data breaches, which can lead to big financial losses and damage to their reputation, showing the need for strong security practices in all sectors.
In 2023, 3,205 data breaches occurred in the United States, impacting over 353 million people, according to Statista. They occurred across public and private industries at the hands of insiders and external bad actors. IBM reports that a single data breach costs a business an average of $4.45 million. Security technology has become more important than ever because no industry is exempt.
Health Care
Health care institutions store some of the most valuable information thieves can steal, including personal information, medical records, usernames, and passwords. The Seattle Times reported that information thieves can sell a stolen health record for $500, compared to just $5 for a stolen credit card number. Buyers can steal patients’ identities, access financial accounts, and fraudulently obtain prescriptions. They can also contact patients directly with spam or threats.
Health care institutions are vulnerable to data breaches because workers are often overworked, and facilities have high turnover rates, leaving little bandwidth for security. Meanwhile, an increased reliance on mobile devices provides greater opportunity for physical theft, while online equipment such as X-rays provides easy access to medical networks.
In 2023 alone, 725 health care data breaches exposed 133 million records. According to IBM, the average cost of a health care data breach is $11 million.
UnitedHealthcare Data Breach
In one of the largest health care breaches in history, a ransomware attack targeted UnitedHealthcare’s subsidiary ChangeHealth Group on February 21, 2024, compromising the sensitive data of an estimated half of all Americans. Even though UnitedHealthcare paid the ransom, the hackers released some private data on the dark web. The breach has substantially disrupted payments to health care providers and disparately impacted rural and low-income community health centers.
The Financial Industry
Financial institutions are virtual goldmines for hackers, who hope to access the following:
- Login credentials of employees and consumers
- Personal information of consumers
- Access to financial accounts
According to the 2023 KPMG Banking CEO Outlook report, only 54 percent of bank CEOs felt well-prepared for a cyber attack in 2023, and 21 percent admitted to feeling under-prepared.
The 2023 Verizon Data Breach Investigations Report reveals that financial gain is the most frequent motive behind financial sector data breaches. However, some attackers are nation-states and hacktivists attempting to manipulate world economics or send a message. Others are insiders who hold grudges. The most common financial sector data breaches are brute force attacks, software vulnerability exploitation, information misdelivery, and malware.
Some banking data breaches occur via skimming devices when a data thief places a pinhole camera, card reader skimmer, or keyboard overlay on ATMs to capture debit card numbers and PINs. In 2022, over 161,000 cards were compromised using this manner.
The average cost of a data breach in the financial sector is $5.9 million.
Examples of Financial Institution Data Breaches
One of the most damaging financial sector incidents was the 2017 Equifax data breach, in which hackers exploited a vulnerability in Equifax’s software and accessed the identifying information and credit card numbers of over 147 million people.
In the 2007 Heartland Payment Systems data breach, hackers used an SQL injection to steal the credit card data belonging to 130 million people. The breach cost the company $300 million in damages. The company suffered a second data breach in 2015 when thieves broke into its offices and stole computers containing credit card information and personal data.
Government Agencies
The Federal Times has reported that 822 local, state, and federal agencies experienced data breaches from 2014 to 2022, compromising 175 million records and costing taxpayers $26 billion.
According to Statista, the most significant government entity breach affected the United States Postal Service, which exposed the personal information of 60 million people. The breach occurred when attackers exploited a weakness in the postal service’s web application.
Government entity data theft is not limited to the federal government. Cities were the most frequent targets in 2022. States are responsible for their own cybersecurity, but a 2022 survey revealed that few states fund cybersecurity or even list it as a budget line item.
Department of Motor Vehicles
While the public can refuse to do business with private entities, they cannot simply choose to avoid the DMV. Thus, people are especially dependent on the DMV to protect their records. Yet hackers have been highly successful in exploiting vulnerabilities in DMV databases and accessing sensitive information. This occurred at the Oregon DMV on June 1, 2023, affecting every Oregonian with an active license, permit, or ID card—a total of 3.5 million people.
Retailers
In 2013, cyber thieves accessed the retail giant Target’s server using login credentials stolen from one of its vendors. The perpetrators made off with the personal information of 70 million customers. Target paid $18.5 million to settle claims by 47 states and the District of Columbia. The retailer claims the total cost of the data breach was $202 million.
This attack was not an isolated incident in the retail world. Verizon identified at least 406 security incidents in 2023 alone, which resulted in 193 confirmed data breaches. The most common mechanisms used by cyber thieves included the following:
- Malware
- Social engineering
- Brute force attacks
- Ransomware
- Stolen credentials
- Skimming devices
- Exploitation of software vulnerabilities
Information thieves steal data from retailers to gain payment card information. In brick-and-mortar locations, information thieves use skimming devices in point-of-sale card readers to capture card information.
Skimmer apps are not limited to physical locations. Cybercriminals use a virtual skimmer app called Magecart to capture credit card data from e-commerce websites. It has been used against MyPillow, AmeriSleep, British Airways, Forbes Magazine, and many others.
Schools
K-12 schools have become hot targets for data thieves. Identity thieves value children’s personal information more than adults’ because most parents do not monitor their children’s credit reports. This allows identity thieves to take out loans and accumulate debt for years without detection. Schools hold almost all the information there is to know about every child, including the following:
- Personal information
- Medical information
- Psychiatric records
- Lists of medications
- Discipline information
- Grades
The Minneapolis Public School system was hit with a ransomware attack in 2023 and refused to pay. The hackers released children’s Social Security numbers and school security details about sexual assaults and psychiatric holds. The breach may have affected 105,000 people and could continue to affect the children well into adulthood.
Technology Companies
Big Tech companies like Google, Microsoft, and Meta gather vast amounts of data regarding consumers, making them chief targets for information thieves. Due to the large number of businesses relying on these companies, hackers can access the data of multiple businesses through a single attack on a major tech company. Financial gain is the most common motive. However, social media companies are also vulnerable to attacks by political and ideological hackers due to the fast spread of information on these sites.
In the notorious Facebook/Cambridge Analytica data breach, Facebook allowed Cambridge Analytics to harvest the personal information of an estimated 87 million of the social media platform’s users to form psychological profiles and determine how they might vote. The information was intended to benefit Donald Trump’s 2016 presidential campaign.
Manufacturing Companies
The manufacturing industry is also vulnerable to data breaches because it relies on the Internet of Things, which includes sensors, GPS trackers, barcode scanners, and industrial robots. These connected devices are often easier to infiltrate than computer systems, but access to one connected device could result in access to a manufacturer’s entire network.
Companies in the manufacturing industry have an especially high stake in preserving their intellectual property, which may be accessed during a data breach.
In 2023, the semiconductor company Applied Materials suffered a data breach, most likely through its industrial equipment supplier, MKS Instruments. On February 3, 2023, MKS Instruments sustained a ransomware attack that affected 3,200 servers and cost Applied Materials $250 million. The semiconductor industry is a popular target because all electronic equipment relies on it, allowing cybercriminals to cause serious supply chain disruptions.
The Hospitality Industry
Data breaches against hotels, motels, cruise ships, and restaurants cost an average of $3.4 million, and they can destroy a company’s reputation in an industry that relies heavily on customer satisfaction for continued business. Approximately 31 percent of hospitality businesses have had at least one data breach, and 89 percent of those have had more than one in a year. The most common tactics include:
- Emailed malware
- Phishing
- Scams
- Compromised business email
- Credential theft
- SQL Injections
- Brute force attacks
Hackers are mostly interested in obtaining payment and personal information. Hotels and motels are vulnerable because of so-called dirty networks, which result from a large volume of new customers daily using Wi-Fi networks that are always on. Also, their high turnover rates and less sophisticated workforce make maintaining effective security training programs difficult.
Marriott has experienced seven data breaches, the most severe of which occurred during the acquisition of Starwood Hotels in 2014. Starwood’s network was already compromised, but Marriott was lax about checking its security. The breach exposed the personal information of 300 million guests, including some payment card data.
Marriott paid $23.8 million in penalties. The Chinese government is believed to have carried out the attack.
Energy and Utilities
In December 2023, Security Magazine reported that 90 percent of the world’s leading energy companies have experienced a third-party data breach in the last 12 months. The top attack methods include ransomware, stolen credentials, SQL injections, and misdelivery of information. According to Verizon, ransomware attacks account for approximately a third of all attacks in the mining, quarrying, oil and gas extraction, and utilities industries.
The primary motivation is financial, but espionage is involved in up to 32 percent of cases. Compromised data includes personal information, internal information, and credentials.
The Colonial Pipeline ransomware attack in 2021 disrupted gasoline supplies, causing the pipeline’s operator to pay a $4.4 million ransom. Investigators found that an employee’s stolen VPN password was sold on the dark web and used to access the system.
Large utilities are not the only targets. In 2021, hackers allegedly gained remote access to the water treatment plant in Oldsmar, Florida, a city of 15,000 people, and increased the lye content of the water to highly toxic levels. Fortunately, a plant worker caught the breach before the water reached customers. Water supplies are vulnerable because digital systems are increasingly used to remotely monitor chemical levels, water pressure, and temperatures.
IBM reports that the average cost of an infrastructure data breach is $5 million.
Contact Class Action U
If your information has been leaked via a data breach, there are steps you can take to protect yourself. In addition, you may be entitled to compensation for the resulting harm. Class Action U provides resources for those affected by data breaches. Contact us today to schedule a free consultation with a data breach lawyer.
"*" indicates required fields
