2011: The Year Of The Breach

We are six months into 2011, and it seems destined to be "The Year of the Breach."  In just the past few months, major American (and multi-national) corporations and institutions have reported that they have been the victims of some kind of security breach:

• Epsilon: breach of customer email addresses;
• RSA: compromise of security tokens (possibly impacting Lockheed Martin);
• Citigroup: breach of credit card numbers:
• Sony: multiple thefts of customer data;
• Sega: customer data theft; and
• ADP: breach of its benefits-administration business.

What does this mean? First, there are simply more breaches to report. Second, companies are being more open about reporting breaches, both because they are legally required to and because such disclosures are expected by consumers and regulators. Third, these breaches and the resulting publicity will bring legal and corporate reactions.