Hackers, mistakes, bad security and stupidity are putting your data at risk like never before In the battle to keep your personal information private, it’s not just hackers you have to worry about but lax security and stupidity.A survey of data breaches in the first six months of this year shows an increasing number of incidents in which data, including names and addresses, credit card and Social Security numbers, and medical records was lost to criminals or exposed.[How to protect your company from an eBay-like breach]In many of the cases, the breaches were put down to poor data security practices or simple errors: like St. Vincent Breast Center in Indianapolis sending 63,000 letters containing information on upcoming appointments to the wrong people, or Stanford Federal Credit Union accidentally attaching a file with information on 18,000 customers to an email, or the thousands of paper medical records dumped at a public incineration site in York, Pennsylvania. In other cases, laptops or thumb drives containing information were stolen — in some cases with apparently nothing more than the login password to protect the data.One of the biggest such cases involving laptop theft occurred at the Torrance, California office of Sutherland Healthcare Solutions, which lost eight laptops in a February break-in. The laptops contained medical information on almost 400,000 people in California, and their theft has sparked lawsuits. According to the Identity Theft Resource Center, there have already been 395 data breaches in the U.S. this year that have been reported to regulators or covered by media outlets, a 21 percent increase over the same period last year.Here are the top five data breaches of the first half of 2014, with an extra entry for eBay. That breach appears to be one of the largest yet, but the exact extent of the problem has not yet been divulged by the company, so it’s difficult to quantify how big it actually was.eBayThe online retailer suffered one of the biggest data breaches yet reported by an online retailer. Attackers compromised a “small number of employee log-in credentials” between late February and early March to gain access to the company’s network and, through it, compromised a database that contained customer names, encrypted passwords, email addresses, physical addresses, phone numbers and dates of birth. The breach is thought to have affected the majority of the company’s 145 million members, and many were asked to change their passwords as a result.Michaels StoresThe point-of-sale systems at 54 Michaels and Aaron Brothers stores “were attacked by criminals using highly sophisticated malware” between May 2013 and January 2014. The company said up to 2.6 million payment card numbers and expiration dates at Michaels stores and 400,000 at Aaron Brothers could have been obtained in the attack. The company received confirmation of at least some fraudulent use. Montana Department of Public Health and Human ServicesTriggered by suspicious activity, officials conducted an investigation in mid-May that led to the conclusion that a server at the Montana Department of Public Health and Human Services had been hacked. The server held names, addresses, dates of birth and Social Security numbers on roughly 1.3 million people, although the department said it has “no reason to believe that any information contained on the server has been used improperly or even accessed.”Variable Annuity Life Insurance Co.A former financial adviser at the company was found in possession of a thumb drive that contained details on 774,723 of the company’s customers. The drive was provided to the company by law enforcement as the result of a search warrant served on the former adviser. The thumb drive included full or partial Social Security numbers, but the insurance company said it didn’t believe any of the data had been used to access customer accounts. It’s not the first time the company has lost data on a thumb drive. In 2006, it wrapped up a lawsuit against a former financial adviser for downloading “confidential customer information” onto “a portable flash drive.” Spec’sA 17-month-long “criminal attack” on the Texas wine retailer’s network resulted in the loss of information of as many as 550,000 customers. The intrusion began in October 2012 and affected 34 of the company’s stores across the state. It continued until as late as March 20 this year, and the company fears hackers got away with customer names, debit or credit card details, card expiration dates, card security codes, bank account information from checks and possibly driver’s license numbers.[State of Montana sends out 1.3 million data breach notifications]St. Joseph Health SystemA server at the Texas health care provider was attacked between Dec. 16 and 18 last year. It contained “approximately 405,000 former and current patients’, employees’ and some employees’ beneficiaries’ information.” This included names, Social Security numbers, dates of birth, medical information and, in some cases, addresses and bank account information. As with many other hacks, an investigation wasn’t able to determine if the data was accessed or stolen.Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news for The IDG News Service. Follow Martyn on Twitter at @martyn_williams. Martyn’s e-mail address is martyn_williams@idg.com Related content opinion Cybersecurity professional job-satisfaction realities for National Cybersecurity Awareness Month Half of all cybersecurity pros are considering a job change, and 30% might leave the profession entirely. CISOs and other C-level execs should reflect on this for National Cybersecurity Awareness Month. By Jon Oltsik Oct 03, 2023 4 mins CSO and CISO CSO and CISO C-Suite feature The value of threat intelligence — and challenges CISOs face in using it effectively Knowing the who, what, when, and how of bad actors and their methods is a boon to security, but experts say many teams are not always using such intel to their best advantage. By Mary K. Pratt Oct 03, 2023 10 mins CSO and CISO CSO and CISO CSO and CISO news CIISec secures government funding to expand CyberEPQ program The funding will support places for 400 students with a focus on attracting a diverse pool of UK cybersecurity talent. By Michael Hill Oct 03, 2023 3 mins IT Training Careers Security news Multibillion-dollar cybersecurity training market fails to fix the supply-demand imbalance Despite money pouring into programs around the world, training organizations have not managed to ensure employment for professionals, while entry-level professionals are finding it hard to land a job By Samira Sarraf Oct 02, 2023 6 mins CSO and CISO Technology Industry IT Training Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe