Attacks/Breaches

2/5/2019
03:00 PM
0%
100%

Over 59K Data Breaches Reported in EU Under GDPR

In addition, 91 reported fines have been imposed since the regulation went into effect last May.

The General Data Protection Regulation (GDPR) officially went into effect across the European Union on May 25, 2018. Since then, more than 59,000 personal breaches have been reported to regulators.

New data breach notification laws have "fundamentally changed" the risk profile of businesses hit with data breaches, reports global law firm DLA Piper. Breaches likely to cause harm to individuals affected must be reported. Failure to comply can cost fines up to €10 million ($11.4 million) or up to 2% of the firm's global annual turnover for the previous financial year – whichever is higher.

In the eight months since GDPR has been applied, 91 reported fines have been imposed. Not all were for personal data breaches. The highest to date was a €50 million ($57 million) fine imposed on Google related to processing personal data for advertising without valid authorization. A German company was fined €20,000 ($22,810) for failing to hash employee passwords, which led to a security breach.

The Netherlands reported the most data breaches (15,400 incidents), followed by Germany (12,600) and the United Kingdom (10,600). Those with the lowest number of breaches reported include Lichtenstein (15), Iceland (25), and Cyprus (35). Cyberattacks reported under GDPR range from minor security breaches to major, publicized hacks affecting millions of individuals.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
2/6/2019 | 3:07:42 PM
GDPR
It seems as if GDPR is doing well in getting companies to publically report its breaches. The question in my mind is will the imposed fines cause these companies to actually increase their security posture. In an ethics class I took long ago, their was a premise that if a fine = x per year but by not implementing the safeguard you saved x + y, then the choice from a cost perspective was obvious. An example of this was Chase bank not adhering to certain aspects of the Dodd-Frank act. They were making much more money per month by circumventing the control than regulators were imposing so the fine essentially became ineffective.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
2/6/2019 | 2:39:31 PM
Do the math
Stand-out statistic.  Since May of 2018 (less than a year ago) there are over 59,000 data breaches reported - so that is 256 a day if you assume about 250 days since inception time.  I am well off but it is an imnpressive number on a per day basis anyway you slice it. 
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7303
PUBLISHED: 2019-04-23
A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 b...
CVE-2019-7304
PUBLISHED: 2019-04-23
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
CVE-2019-0223
PUBLISHED: 2019-04-23
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1...
CVE-2017-12619
PUBLISHED: 2019-04-23
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".
CVE-2018-1317
PUBLISHED: 2019-04-23
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.