4 ms·

Surely the data breaches we hear about are the tip of the iceberg? Just think of what needs to happen after a hack for you to hear about it: - someone at the

Surely the data breaches we hear about are the tip of the iceberg? Just think of what needs to happen after a hack for you to hear about it: - someone at the company needs to be aware it has happened. - they need to accurately identify what was accessed. - they need to disclose that this has happened. - it needs to be visible enough that it gets picked up and talked about. Each step of that funnel must have some drop-off that is non-zero. Do we hear about 80% of breaches? 5%? Honestly I’ve no idea.

sofixa 3y ago
Well thankfully point #3 is mandatory in places with laws such as the GDPR or California or Brazil's equivalents which mandate disclosure to impacted users and publicly.
- willcipriano 3y ago
  Murder is similarly forbidden. Still happens.
kossTKR 3y ago
Yes, i'm pretty sure no more than 5% of breches and leaks gets public press. There's so many internal company filters a breach has to go through to become public all the way from some engineer messing up and "just closing the terminal" with a beating heart hoping no one will notice - to a long chain of managers who has to send the message upwards, then the leadership approving public disclosure, all with negative pressure to not disclose because of career, stress, extra work, penalties, all the way to stakeholder value.
lofaszvanitt 3y ago
Just get into the proper forums and see all the data offered for sale.
rightbyte 3y ago
I would honestly guess about 0.1% of bad leaks (e.g. not just email and user name or whatever) are disclosed in the end. It has to be really hard for the police or card providers to correlate frauds with customer databases. And like, how do you even notice you are hacked? Unless the hacker sends you extortion messages, which I guess is the main reason for disclosure. Otherwise the hacker can tip off the an attorney and 'pwn' corporate lawyers for real. A risk the lawyers won't take even if the company wanted to. I sometimes feel lawyers are the only group of workers with real agency ...
ourmandave 3y ago
And finding out shouldn't be like pulling teeth.
- iAMkenough 3y ago
  Delta should leave the teeth pulling to the dentists.
droopyEyelids 3y ago
You're only looking at it from one end of the funnel. On the other end you have security researchers who are active in the cybercrime underground markets, and have the same opportunity to buy stolen data as the criminals themselves. So disclosure can come from the other end when it becomes apparent that a certain company's data is being sold, and I think almost all of it does get sold eventually, even if the initial hacker has a way to exploit it privately: After they've finished, they can make money selling the leftovers.

sofixa 3y ago

Well thankfully point #3 is mandatory in places with laws such as the GDPR or California or Brazil's equivalents which mandate disclosure to impacted users and publicly.

willcipriano 3y ago
Murder is similarly forbidden. Still happens.

kossTKR 3y ago

Yes, i'm pretty sure no more than 5% of breches and leaks gets public press. There's so many internal company filters a breach has to go through to become public all the way from some engineer messing up and "just closing the terminal" with a beating heart hoping no one will notice - to a long chain of managers who has to send the message upwards, then the leadership approving public disclosure, all with negative pressure to not disclose because of career, stress, extra work, penalties, all the way to stakeholder value.

lofaszvanitt 3y ago

Just get into the proper forums and see all the data offered for sale.

rightbyte 3y ago

I would honestly guess about 0.1% of bad leaks (e.g. not just email and user name or whatever) are disclosed in the end. It has to be really hard for the police or card providers to correlate frauds with customer databases. And like, how do you even notice you are hacked? Unless the hacker sends you extortion messages, which I guess is the main reason for disclosure. Otherwise the hacker can tip off the an attorney and 'pwn' corporate lawyers for real. A risk the lawyers won't take even if the company wanted to. I sometimes feel lawyers are the only group of workers with real agency ...

ourmandave 3y ago

And finding out shouldn't be like pulling teeth.

iAMkenough 3y ago
Delta should leave the teeth pulling to the dentists.

droopyEyelids 3y ago

You're only looking at it from one end of the funnel. On the other end you have security researchers who are active in the cybercrime underground markets, and have the same opportunity to buy stolen data as the criminals themselves. So disclosure can come from the other end when it becomes apparent that a certain company's data is being sold, and I think almost all of it does get sold eventually, even if the initial hacker has a way to exploit it privately: After they've finished, they can make money selling the leftovers.