Security news: one in six may have had private personal data compromised.

Up to 1000 million in the UK may have had private, personal data compromised this year alone if a pattern of loss similar to the United States has been repeated elsewhere.

However in the UK--unlike some US states--there is no legal obligation for companies to disclose personal information losses. Individuals have no way of knowing if they may now be vulnerable to identity theft, the only way to find out is if something happens to them, hi 2004, just 120,000 detected identity- thefts cost the UK around [pounds sterling]34 billion in fraud.

Data collected by the US consumer organisation Privacy Rights Clearinghouse reveals that, since February, more than 50 million Americans may have had their personal information compromised. Causes include hacking, dishonest employees, stolen computers and lost backup tapes. What is worrying is that these data losses could be the tip of the iceberg.

For example, what if someone borrows and copies a backup tape and puts it back?

There is no telling how far reaching this type of incident could be, or what type of personal information may be compromised, be it financial, medical or other.

According to data security company DISLIK, it is difficult to identify any one source of personal information loss, because of the wide variation in type of incidents, scale of loss and where they occur.

Institutions ranging from banks to universities to the Department of Justice have reported losses. In the USA, one hacking incident put 40 million sets, of details at risk; which was by far the biggest single event. A pro rata data loss like this in the UK would put the details of a mind-blowing 8 million individuals, at risk.

However, this one event skews the statistics and obscures the significance of other sources of data loss. If this incident is excluded, the average number of details compromised through hacking is 73,685, compared to an average of more than 135,858 for all loss types.

Quite rightly, almost every company-makes secondary, offline--'backup'--copies of its data, in case the primary copy is lost or becomes corrupted for any reason. The potential for information theft exists because the most popular medium for storing these backup copies is magnetic tape. Magnetic tapes, as physical objects, can be lost or stolen, and the data stored on them is typically unencrypted--making it easily readable by even a moderately skilled third party and leaves no audit trail.

'The problem is that a lot of the information used in identity theft--stuff like old addresses, date of birth, place of birth and mothers maiden name--never changes. Its quite conceivable that an identity thief could acquire personal details now and then wait months or even years before borrowing money or applying for a credit card. There is not much of a time limit on a lot of this information and, with the reporting miles as they are, there is no way for victims to be forewarned or to know when their personal information may have been compromised.'

The Definitive Guide to Data Loss. DISUK

www.disuk.com