The number of data breaches in 2013 tripled … and much more

Risk Based Security-the Open Security Foundation issued a report to provide a summary of the key findings from analysis of 2013 data breaches

Risk Based Security and the Open Security Foundation have conducted a study on 2,164 data loss incidents reported in 2013 producing an interesting report that could help us to better understand the causes and the dynamics for occurred data breaches. The first data that catches the eye is that the majority of that data breached involved outside attackers (72%) meanwhile the insiders are responsible only for 25 percent of the incidents mainly caused by accidents and human error.

“Fraud/Social Engineering is overwhelmingly the mode of choice for inside malicious actor.”

The number of data loss incidents observed in 2013 is increased in an impressive way it’s, in fact, three times bigger than the number of data breaches in 2012, the number of records exposed in 2013 data breaches has reached 823 million.

As expected businesses are the primary victims of the incidents, followed by government, medical and educational institutions, 45.5% of the data breaches hit entities based in the US.

Alarming also the second place occupied by South Korea in which data loss incidents caused the exposure of 140 million email addresses and identification numbers,  security experts are confident that were compromised by North Korean cyber units that are very active against South Korea government and national businesses.

US organizations accounted for 66.5% of the compromised records, a deeper look within the US states reveals that the ranking is led by the  California which accounted for 370 million records exposed.

A cyber attack exploited the Adobe company drives the “Top 10 Incidents All Time“,  the hack of company systems exposed customer names, IDs, encrypted passwords and debit/credit card numbers with expiration dates, source code and other information relating to customer orders 152 Million Adobe Systems.

“Hacking stands out as a leading breach type in the multiple incident dataset.”


The number of exposed records for the attacks occurred in 2013 is very high because many massive data breaches occurred, 51.1% of incidents exposed between 1 and 1,000 records and the number of exposed records was reported as “Unknown” in 26.4% of the 2013 incidents.

260 of the data breaches disclosed in 2013 were a direct consequence of previous incidents which impacted the organization, and sixty organizations reported multiple incidents during 2013.

Following the key findings from the report:

  • There were 2,164 incidents reported through December 31, 2013 exposing 822 million records.
  • A single hacking incident involving Adobe Systems exposed 152 million names, customer IDs, encrypted passwords, debit or credit card numbers and other information relating to customer orders.
  • The Business sector accounted for 53.4% of reported incidents, followed by Government (19.3%), Medical (11.5%), Education (8.2%), and Unknown (7.6%).
  • The Business sector accounted for 73.9% of the number of records exposed, followed by Unknown at 24.5%.
  • 59.8% of reported incidents were the result of Hacking which accounted for 72.0% of exposed records.
  • 4.8% of the reported incidents were the result of Web related attacks which accounted 16.9% of exposed records.
  • Breaches involving U.S. entities accounted for 48.7% of the incidents and 66.5% of the exposed records.
  • 51.1% of the incidents exposed between one and 1000 records.
  • Twenty-seven incidents have exposed more than one million records.
  • Four 2013 incidents have secured a place on the Top 10 All Time Breach List.
  • The number of reported exposed records tops 2.5 billion and the number of reported incidents tracked by Risk Based Security exceeded 11,200.

Pierluigi Paganini

(Security Affairs –  Data breaches 2013, security)

Pierluigi Paganini: Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

This website uses cookies.