The Top 10 Data Breaches of 2007

Stolen hard drives, websites infected with malware and Social Security numbers as passwords--the most brilliant lunacy of a year full of security disclosures.

By Scott Berinato

December 12, 2007 — CSO — By Scott Berinato

If there’s only one thing you’ll remember from 2007, it will be Britney Spears’ meltdown. But if there are two things you remember, it will be Britney and the thousands of data breaches that were reported in 2007, right? Right? Well, it’s what we’ll remember, and since we don’t necessarily do celeb gossip (unless you’ve got a good security angle…) we decided to offer up a review of the best and worst of Disclosure ’07.

Each breach gets rated on our nifty, unscientific "Class-Action Outrage Scale," judging the likelihood that ambulance-chasing lawyers could have a field day. Look out Monster.com: We estimate nine of 10 lawyers are outraged on behalf of your 1.3 million victims.

Our "D’oh! Factor" (thank you, Homer Simpson) reflects just how egregious and goofy the breach was. Take a look at how Swedish Urology Group earned itself five out of five Homers. Ick.

Some breaches on our list are serious. Some are funny. And some are just plain sad. But all of them were probably preventable. Alas.

10. Monster.com -- New Job Posting on Monster.com: CISO for Monster.com?
Victims: 1.3 million
Class Action Outrage Scale: 9 out of 10 lawyers
D’oh! Factor: 2 out of 5 Homers

Hackers allegedly stole legitimate credentials from Monster’s job-seekers to plant malware on the site and execute a phishing scheme. Later we come to learn Monster waited five days to inform customers. When it did, the disclosure letter sounded like a legal CYA, referring to Monster as "The Company" and constantly reminding victims that this kind of things happens to companies all the time. The news hit right after Monster reported lower-than expected earnings and planned layoffs. Ouch!

9. Commerce Bank of Wichita, Kansas -- Now That’s Just Showing Off
Victims: 20
Class Action Outrage Scale: 0 out of 10 lawyers
D’oh! Factor: 1 out of 5 Homers

So Commerce discloses that a hacker gained access to a customer database, but that the bad guys only managed to ascertain 20 personal records. "The hacking was quickly detected and stopped, according to the bank," noted one news story. Twenty records? Anyone else get the sense this is some marketing scheme? You know, set up a breach and stop it quickly to show how effective your security is? PR Genius!

8. Indianapolis Power and Light -- Keeping the Lights on a Little Too Long Maybe
Victims: 3,000
Class Action Outrage Scale: 4 out of 10 lawyers
D’oh Factor: 4 out of 5 Homers

Names, addresses and Social Security numbers of 3,000 Indianapolis Power and Light customers were inadvertently posted online ... for up to four years. Of course, a power outage would have solved the problem.