Study: Retailers, Financial Companies Most Vulnerable to ID Theft

CIO — As the data breach case against retailer TJX unfolds in federal court, a study by the Center for Identity Management and Information Protection at Utica College finds that retailers are most vulnerable to identity theft by employees, and that financial services companies are the most likely businesses to suffer losses from identity theft-related crimes.

Researchers studied data supplied by the U.S. Secret Service about 517 cases it investigated between 2000 and 2006. Although most identity theft cases against companies were perpetrated by outsiders, among 176 cases that were inside jobs, 44 percent targeted retailers.

No matter who perpetrated the crime, investigators reported individuals' personal information was stolen most often from a business, rather than through a family member or friend, from the person's home, or online. Ninety percent of the victims who suffered financial losses were financial services companies or individuals, with some overlap between the two categories. The study was released Oct. 22.

On Oct. 23, in court filings related to the TJX case, banks suing TJX alleged that thieves stole 94 million account numbers, more than twice the number TJX originally reported, according to the Boston Globe. Security experts already considered the TJX data breach, which was disclosed in January, to be the largest ever reported.

TJX estimates a settlement with consumers who were victims of the breach would cost around $256 million, though analysts think the final tally may hit $1 billion.

Other findings from the Center for Identity Management and Information Protection study include:

• In 45 percent of cases, offenders used stolen IDs to obtain credit. One-third used them to get cash, and 23 percent used them to conceal their own identities.


• Perpetrators used the Internet to steal identities in only 20 percent of all cases. However, researchers said they did not have enough data to draw conclusions about whether online theft is becoming more common than it was earlier this decade.


• The more organized the thieves were, the more victims lost. In 57 percent of cases, a single defendant stole an average of $22,500. Victims' losses rose to an average of $42,700 in the 23 percent of cases in which there were two conspirators. Rings of five identity thieves, accounting for 17 percent of cases, captured more than $84,000 from their victims on average.


• Three-fourths of offenders were between the ages of 25 and 49. Slightly more than three-fourths were born in the United States.

For a copy of the study (registration required), click here