[Previous entry: "SQL Injection and Data Security Breaches"] [Next entry: "Computer Misuse Act Section 3a clarification"]

10/27/2007: "4000 Breaches!!!"

I read a story the other day reporting that the Office of Management and Budget issued a memo in July 2006 requiring agencies to report all security incidents that may involve PII within an hour. A year later 4000 incidents had been reported. 4000. Ok, even if as Karen Evans says that only a small percentage turned out to be "real" incidents that's still a huge amount - even just 1 percent is 40. The figures coming through the Privacy Right Clearing House / Attrition must be just the tip of the iceberg of known breaches - let alone of course the unkown.