Hacker News Reader

Hacker News

Comment by highwaylights | Hacker News Reader

Parent Full thread

highwaylights

Surely the data breaches we hear about are the tip of the iceberg?

Just think of what needs to happen after a hack for you to hear about it:

- someone at the company needs to be aware it has happened.

- they need to accurately identify what was accessed.

- they need to disclose that this has happened.

- it needs to be visible enough that it gets picked up and talked about.

Each step of that funnel must have some drop-off that is non-zero. Do we hear about 80% of breaches? 5%?

Honestly I’ve no idea.

View on HN

Yes, i'm pretty sure no more than 5% of breches and leaks gets public press.

There's so many internal company filters a breach has to go through to become public all the way from some engineer messing up and "just closing the terminal" with a beating heart hoping no one will notice - to a long chain of managers who has to send the message upwards, then the leadership approving public disclosure, all with negative pressure to not disclose because of career, stress, extra work, penalties, all the way to stakeholder value.

You're only looking at it from one end of the funnel.

On the other end you have security researchers who are active in the cybercrime underground markets, and have the same opportunity to buy stolen data as the criminals themselves.

So disclosure can come from the other end when it becomes apparent that a certain company's data is being sold, and I think almost all of it does get sold eventually, even if the initial hacker has a way to exploit it privately: After they've finished, they can make money selling the leftovers.

And finding out shouldn't be like pulling teeth.

Delta should leave the teeth pulling to the dentists.

I would honestly guess about 0.1% of bad leaks (e.g. not just email and user name or whatever) are disclosed in the end.

It has to be really hard for the police or card providers to correlate frauds with customer databases.

And like, how do you even notice you are hacked? Unless the hacker sends you extortion messages, which I guess is the main reason for disclosure. Otherwise the hacker can tip off the an attorney and 'pwn' corporate lawyers for real. A risk the lawyers won't take even if the company wanted to.

I sometimes feel lawyers are the only group of workers with real agency ...

Well thankfully point #3 is mandatory in places with laws such as the GDPR or California or Brazil's equivalents which mandate disclosure to impacted users and publicly.

Murder is similarly forbidden. Still happens.

Just get into the proper forums and see all the data offered for sale.

Reply on news.ycombinator.com