GAO Says Data Breaches Rarely Result in Identity Theft

The U.S. Government Accountability Office reported last week that many consumer-data security breaches have occurred, but the breaches seldom result in identity theft or financial fraud.

The agency found that between January 2005 and December 2006, more than 570 separate data breaches were reported by various media outlets, according to the GAO’s report on data breaches. Additionally, a survey from the House Government Reform Committee identified 788 data breaches at 17 government agencies from January 2003 to July 2006. The breaches have occurred at federal, state, and local governments, retailers, financial institutions, colleges and universities, and medical facilities.

The GAO reported it is difficult to find a direct link between a breach and a case of identity theft, in large part because it can be difficult to determine the source of the data used to commit identity theft. The agency defined identity theft as account fraud or unauthorized creation of new accounts. It said that interviews with researchers, law enforcement officials, and industry representatives indicated that most breaches have not resulted in detected incidents of identity theft.

The GAO said the government itself lacks comprehensive data on breaches, causing the agency to build its report using media coverage of high-profile data breaches and information from three private organizations.

The GAO drilled down on the 24 largest data breaches reported in the media from 2000 to 2005. There was no evidence to indicate identity theft had occurred in 18 of the cases; breaches appeared to have resulted in fraud on existing accounts in three of the cases; and one breach appeared to have resulted in the unauthorized creation of new accounts. The other two cases lacked evidence to make a definitive determination, according to the agency.

The report did not make any recommendations, but noted that the lack of identity theft in most data breaches may be a result of increased efforts to notify consumers when a potential breach is discovered.