Pair Of Fines Levied On Breached Companies Show Real Costs Of Database Hacks

Two different companies in the past two weeks were fined by regulatory agencies for separate database breaches, totaling well over $1 million. The fines serve as a concrete and eye-opening example of what can happen to a business that fails to lock down its precious data stores, and also a warning that the toothless compliance mandates of yesteryear really do have bite now.

The two breach incidents in question are on opposite ends of the spectrum in regard to cause. The first was an insider breach initiated by a former DBA at Certegy, a wholly owned subsidiary of Jacksonville, Fla.-based Fidelity National Information Services (FIS), which cost the company $975,000 in fines to the Florida Attorney General. The second was an external attack precipitated by a SQL injection exploit against a customer database owned by brokerage firm Davidson & Co., for which the Financial Industry Regulatory Authority (FINRA) fined the firm $375,000.

"In one case it was hackers, and in another case it was an internal employee -- a DBA -- but in both the issue was that they didn't have any real-time monitoring in place. That's how these two stories are related," says Phil Neray, vice president of security strategy of Guardium, an IBM company. "What a SQL injection attack [does] is give the attacker privileged user credentials. So if you're monitoring your privileged users like your DBAs, you're also getting the bonus of monitoring for external threats at the same time."

According to Ponemon Institute, the current average organizational cost of a data breach stands at about $6.75 million. The more extreme case among the two fined companies was Certegy's breach, which shows how database breach costs can really rack up for a company: A malicious insider at the company exposed about 5.9 million customer records. The $850,000 fine levied by Florida to pay its investigative costs and attorney fees, and the additional $125,000 demanded to help fund a statewide crime prevention program, are just a tip of the breach cost iceberg for Certegy. In 2008, the company settled a class-action lawsuit that cost it $4 million. Additionally, the company is now required by the state of Florida to conduct a yearly security assessment.

"There are a lot of costs there, not just in terms of paying for the audits, but in terms of the time and the resources that are going to be required internally to support that audit," Neray explains.

The big fines doled out to Certegy and Davidson & Co. act not only serve as a punishment, but also as a deterrent and warning to others. When it meted out its punishment to Davidson & Co., FINRA had its chief enforcer issue a strong warning to other brokers.

"Broker-dealers must be especially vigilant about protecting its customers' confidential information, which includes ensuring that its technology is sufficient," said James Shorris, executive vice president and executive director of enforcement for FINRA, in a statement. "In this case, the firm placed its database containing confidential customer information on a server that was perpetually exposed to the Internet, but failed to implement basic safeguards to protect that data -- even though the firm had been advised before this incident to implement an intrusion detection system."

Neray believes firms would do well to heed Shorris' warning -- the Davidson & Company breach in his mind is a classic morality tale of the security world. Paying attention to the ramifications of the breach and how it happened in the first place can offer companies a lot of instruction.

"The Davidson breach is a really great example because it has all the classic aspects of cybercrime in the 21st century. It's got hackers in Eastern Europe using Western Union to try to launder the money, and it's got extortion," Neray says. "It's got SQL injection as an intrusion mechanism and ... they were relying on manual reviews of logs, which we know doesn't work because it happens long after the breach has occurred and because there is so much data contained in those logs that a human can't really find suspicious or unauthorized activity easily. And it had a database with a blank password, which if they were using automated vulnerability assessment tools would have been quickly found."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.