<html>
<body>
<font size=3>Note, they're now claiming the VA losses at 28.7 million,
due to spousal info. <br>
</font><font face="Georgia" size=3>
<a href="http://www.newswithviews.com/Stuter/stuter94.htm" eudora="autourl">
http://www.newswithviews.com/Stuter/stuter94.htm<br><br>
</a></font>At 17:30 6/27/2006, you wrote:<br><br>
<br>
<blockquote type=cite class=cite cite="">For the past few days, I've been
doing more research on recent data breaches, <br>
especially including types of breaches and numbers affected. One
number keeps <br>
coming up in the media: 88 million. In many cases, "88
million" is described <br>
as the number of compromised records. In other cases, it is
described as <br>
"Americans" or "people":<br><br>
<a href="http://www.first.org/newsroom/globalsecurity/32460.html" eudora="autourl">
http://www.first.org/newsroom/globalsecurity/32460.html</a>
(Americans)<br><br>
<a href="http://biz.yahoo.com/bizwk/060623/b3991041.html" eudora="autourl">
http://biz.yahoo.com/bizwk/060623/b3991041.html</a> (Americans)<br><br>
<a href="http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9001282" eudora="autourl">
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9001282</a>
<br>
(records)<br><br>
<a href="http://www.internetnews.com/security/article.php/3615461" eudora="autourl">
http://www.internetnews.com/security/article.php/3615461</a>
(people)<br><br>
We know that the number 88,000,000 or so has been calculated by adding
the <br>
number of total people affected from all listed breaches since
Choicepoint in <br>
February 2005. Looking at this total though, it seems to me that
the number is <br>
inflated due to the fact that it appears to represent unique
individuals. The <br>
VA breach really caused me to take a better look at the situation and
rework <br>
some of the numbers.<br><br>
In this situation, all numbers are estimates and examples are
hypothetical. <br>
Let's use 26.5 million as the estimated number of people affected in the
VA <br>
breach. Because the total U.S. popluation is approaching 300
million, 26.5 <br>
million would represent one out of every eleven U.S. citizens, or roughly
nine <br>
percent. For rounding purposes, let's say about ten percent of U.S.
citizens <br>
were affected by the VA breach.<br><br>
88,000,000 total<br>
minus<br>
26,500,000 VA<br>
----------------<br>
61,500,000 non-VA breached<br><br>
Assuming ten percent of the U.S. population has been in the military
based on <br>
the VA numbers, it would be safe to estimate that about 6.15 million
former <br>
vets were involved in all other breaches. Those 6.15 million would
be <br>
duplicated in the VA total, so should be subtracted from the overall
total, <br>
which would then equal about 81.85 million.<br><br>
But what about other duplicates? I'm sure many people were affected
by more <br>
than one breach. Those with records in the Choicepoint incident may
likely <br>
have been affected by the LexisNexis breach. Someone with an
Ameriprise <br>
account may have been cared for by Providence Home Services. It probably
goes <br>
on and on to the point that the *unique* number of people affected will
<br>
probably never be accurately determined. I can understand saying 88
million <br>
"records" have been breached, but if we're judging by records
and not <br>
individuals, then Acxiom would have been the worst breach of all
time:<br><br>
<a href="http://attrition.org/errata/dataloss/2003/12/acxiom05.html" eudora="autourl">
http://attrition.org/errata/dataloss/2003/12/acxiom05.html</a><br><br>
More than a billion records.. but how many individuals? Did each
individual <br>
have ten records per listing in Acxiom's database? Fifty? A
hundred? Did <br>
Acxiom really have the records of one-sixth of the world's population in
a <br>
database? Did the media bother to make this distinction, or just
use the <br>
number "one billion" for shock value without digging to find
the facts?<br><br>
I honestly believe that the media either is using the wrong terminology
when <br>
referring to "number affected" or doesn't understand the
complexity of <br>
quantitatively analyzing how many people are truely affected by data
breaches. <br>
This may be a point for us all to consider when using overall
"totals" as a <br>
statistic in the media. While the number of individual records,
Americans, or <br>
people *per incident* may be relatively accurate, 88 million
"people" or <br>
"Americans" seems high, and it should be the media's
responsibility to make <br>
this distinction.<br><br>
Lyger<br>
_______________________________________________<br>
Dataloss Mailing List (dataloss@attrition.org)<br>
<a href="http://attrition.org/errata/dataloss/" eudora="autourl">
http://attrition.org/errata/dataloss/</a></blockquote></body>
<br />--
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br />believed to be clean.
</html>