I keep reading the words "the largest data breach in history" in a variety of stories. In fact, given the tremendous growth of data acquisition, I'm guessing that this headline will continue to repeat itself over and over. I think I'm getting to the point where I'd rather just see a story say that xxx million customers were affected. At least then I'd be able to easily put some scale to the loss of data.

What's interesting in this case involving JP Morgan is there are indictments being handed down, to at least two men that somehow participated in hacks that copied over 100million people's data. JPMorgan admits 76 million households and 7 million small businesses were compromised, which isn't 100, but perhaps there's something I'm missing. However the data wasn't just sold, but rather hackers used the information to market stocks to the individuals compromised. That's an interesting level of sophistication, and a scary one.

Can you start to imagine criminals using the information intelligently to not directly sell the data but to make a secondary use of the information. Perhaps they will enagage social engineering by bundling the information with other data to perform some other attack on individuals? It's entirely possible that we will see more sophisticated uses in the future as criminals work to evade or avoid the fraud detection systems that have been put in place.

I have no doubt that bigger data breaches are coming. Perhaps we could reduce the impact and frequency with better security frameworks and development practices, but I'm not sure that any company out there will place a high priority on security over ease of access and speed of development. I do continue to hope that market forces will drive companies to build better detection and protection mechanisms, and our vendors will build better security mechanisms into all platforms.