Payment system breaches less common than other Web-based attacks: Study

While the theft of millions of credit card numbers from Target customers last year drew attention to Internet crime, a new study finds that breaches of retail payment systems are less common than other kinds of attacks.

A report from Verizon found that Internet attacks in which data were compromised resulted more often from various small online acts, such people clicking on malicious Web links and choosing easy-to-guess passwords.

The report, considered to be one of the top annual looks at Internet-related crime, includes information from 50 organizations around the world, ranging from law enforcement to security companies. The report was due out Wednesday.

Target Corp.'s breach, one of the largest in history, resulted in the thefts of 40 million credit and debit card numbers, along with the personal information of up to 70 million people. Other companies including fellow retailers Neiman Marcus and Michaels Stores Inc. later announced breaches to their systems as well.

But while such large-scale attacks grab headlines, the number of breaches of payment systems has fallen in recent years. In 2013, there were just 198 recorded breaches of payment systems, representing 14 percent of the year's 1,367 confirmed breaches.

By comparison, data breaches through attacks on Web applications accounted for 490, or 35 percent, and cases of online espionage covered 306 attacks, or 22 percent.

Verizon says its numbers are not comparable with those from previous reports because its research methods and the number of contributors to the report have changed.

Wade Baker, Verizon's managing principal of research and intelligence, said researchers saw a big increase in attacks on smaller retailers a few years ago. But now, he says, it appears that criminals are going after major retailers that handle millions of debit and credit card numbers and leaving the smaller companies alone, even though they are easier to attack.

And regardless of the type of attack and the motivation behind it, cybercrime has gone from a game to a big business.

"It's very industrialized and very sophisticated," he says. "You can buy software packages that are customized. It's never been easier to turn data into money. Those changes are what drive every big-picture trend that we see."

Other findings in the report:
Web application attacks continue to be popular. Those attacks generally stem from the theft of an authorized person's credentials, which could happen by cracking an easy password or by getting someone to click a link in an email. Criminals also sometimes exploit coding flaws in a system to gain entry.

The reasons behind those attacks vary. According to the report, 65 percent of Web application attacks last year either stemmed from political motivations or were the acts of thrill seekers, while 33 percent were financially motivated.

Of last year's recorded cyber espionage attacks, 54 percent were targeted at U.S. victims and 87 percent involved foreign governments. In 49 percent of the cases, the people behind the attacks were located in Eastern Asia and 21 percent came from Eastern Europe.