97% of corporate data breaches are due to employees

For all the time we spend fretting over hackers who would break into our networks and abscond with our secrets, rarely do we stop to consider what those people who're actually authorized to be on the network are doing.

In some sobering news from Compuware, a new study says that the vast majority of data breaches -- roughly 97 percent -- are due to employee carelessness and malice, not those crooks waiting in the shadows outside, eager to hack the network.

As Ars Technica notes, there is no information on the severity of data breaches discussed in the study, including information about the number of people impacted or the type of data taken. In fact, "data breach" isn't even fully defined, but in a nutshell it applies to the loss of "information about individuals such as consumer data, customer information, employee records, and so forth," so a data breach could be construed as everything ranging from customer lists to credit card records and Social Security Numbers. The study says that 79 percent of companies queried have experienced some sort of data loss (though again, Ars rightly notes that not all of these need be worrisome breaches).

The really telling stat here is not how common breaches are but rather that employees (and contractors, including outsourcing partners) are by far the most common avenue for data loss. The vast majority of those are inadvertent -- think about those reports of lost laptops and reams of personal information simply thrown into the Dumpster -- with just 26 percent of companies claiming losses due to malicious employees. Only about 2 or 3 percent of losses are due to outside hackers (I include social engineering in that tally).

Perhaps the worst news of all is that companies don't seem to have a good handle on data breaches (or even detecting when they occur), haven't improved methods for monitoring for breaches in recent years, and experience problems throughout the organization that contribute to such losses. The prognosis for radical improvement in the coming years? Grim.

Read the full report here (registration required, PDF).