“Although TJX suggests that the breach only affected approximately 45.7 million accounts, in fact the breach during a period of 17 months affected more than 94 million separate accounts. To date, Visa has calculated the fraud losses experienced by issuers as a result of the breach to be between $68 million and $83 million on Visa accounts alone.”

Evan Schuman, quoting Visa’s Joseph Majka, in “TJX Breach More Than Twice As Bad As Had Been Reported .”

Would someone please page Willy Sutton?

There’s an article over on Tekrati, “Cost of a sensitive data breach will increase 20 percent per year through 2009, says Gartner.”

Near as I can tell, this is the sort of half-thought through analysis which Gartner sometimes spews, to the great detriment of their reputation. (To be fair, I can only see what other people report on the news, not the original Gartner slide deck.)

Gartner analysts estimate that the cost of sensitive data break will increase 20 percent per year through 2009. While mass attacks such as worms and viruses have continued, the investments that enterprises have made in intrusion prevention, vulnerability management and network access control have paid off, as those simple mass attacks have succeeded much less often. However, the attackers are now more financially motivated and have launched new waves of attacks that, when successful, cause enormous damage to the bottom line, but that often go unreported.

There’s some fascinating juxtapositioning in that last sentence. It “cleverly” mixes new motives for attacks with attacks succeeding, and then implies that there are these secret attacks happening, causing “enormous damage to the bottom line,” but that somehow these material events aren’t being reported. What might the SEC think about that? What might Milberg Weiss say about such allegations? How about Sarbanes and Oxley?

I simply don’t believe that there are real events happening at public companies with real bottom line impacts being covered up. I believe that there are events whose costs are exaggerated. I believe there are events that are reported and not widely publicized. A company which is knowingly not reporting something which has caused “enormous damage to the bottom line” is committing a felony for which their executives can be jailed.

If you’re an information security professional, making claims like this damages your credibility and your career. Similarly, claiming that breaches often drive companies out of business simply isn’t supported by the facts.

However, I made a different assertion, which is that breach costs will fall, and I need to support that or risk damaging my own credibility. Breach cost will fall as the market responds and a growing number of credible organizations offer breach response services. Competition will drive costs down as everyone tries to get in on this new space.

I’d rate the chances as .9 five years out. If I’m wrong, I’ll refund 90% of the money I made on this post.

There’s an interesting case of breach non-disclosure documented in the Edmonton Sun, “Privacy breach at MacEwan.” It’s interesting for a few reasons. First, the breach wasn’t disclosed:

MacEwan College was cited in the auditor general’s report this week after a tipster told the AG’s office about the security breach in 2006. It mirrored access problems in 2002-2003, the AG’s report confirmed.

The college chose not to tell those whose personal information was included in the accessible journal entries based on an assessment of risk by its Freedom of Information and Protection of Privacy office, said MacEwan spokesman Gordon Turtle.

You’ll note that I’m writing about it anyway.

Secondly, people are upset:

Public institutions engender trust, and that’s just one of several reasons why students should have been told, even if the college was confident the breach was minor, said MacEwan Student Union president Justin Benko.

“Based on what the auditor report says, if bank account information and credit card numbers and signatures were readily available and obvious, there should’ve been something said,” he said.

Benko’s opinion is interesting. There’s no Canadian law explicitly requiring breach disclosure, but there’s an expectation of disclosure. (There are also interpretations by Privacy Commissioners that read disclosure into existing laws.)

It also seems that the risk assessment was wrong. If you’re covering up a breach because of a risk assessment, you might want to have another, and include crisis communication in the assessment.