What Is Data Leakage?

Background

According to Network World, companies have invested heavily in systems that protect against data leakage because an incident of lost data can not only result in direct recovery costs, but also in negative publicity and lost customers or business opportunities. According to a 2010 Ponemon Institute study, data breaches cost companies an average of $204 per record, on average. In addition, a data breach that results in negative publicity can result in a lost business opportunity of $128 for each data record leaked, according to a 2008 Network World article.

Data compiled by the SANS Institute, an information technology security firm, revealed that 52 percent of data security breaches are the result of an organization's internal sources, compared to 48 percent from external hackers. In addition, less than 1 percent of the internal data breaches are tied to malicious intent, while 46 percent are related to employee oversight and 50 percent are the result of poor business processes.

Disgruntled employees hacking into a company's computer network is the most common type of activity that results in internal data leakage, according to the SANS Institute. Unintentional data leakage can occur as a result of employees using instant messaging, email, webmail, peer-to-peer networks, blogs or wikis, malicious Web pages, file transfer protocol technologies and even on removable media storage devices such as USB drives, according to the SANS Institute. A person rummaging through an organization's dumpster can discover sensitive data on printed materials or on CDs.

The most serious loss of personal data in U.S. history involved TJX Companies Inc., owner of several retail brands such as T.J. Maxx, Marshalls and Bob's Stores. In January 2007, Framingham, MA-based TJX announced that intruders had breached the company's computer system and stolen millions of credit card and debit card numbers of its customers. In March 2007, TJX disclosed that 45.6 million credit card and debit card numbers were stolen. The systems that were broken into were related to checks, merchandise that was returned without receipts, credit cards and debit cards, according to Computerworld.

In August 2006, the Department of Veterans Affairs announced that a subcontractor who worked for the VA offices reported his laptop computer missing. The computer stored the personal records of possibly as many as 38,000 veterans. The laptop was later recovered, and the incident prompted the VA to use encryption software to protect data on laptops used by the agency.