A new report published this month says roughly 3.4 million residents of Washington fell victim to data breaches between July 2017 and July 2018.
Washington state Attorney General Bob Ferguson’s Data Breach Report says categorizes data breaches into three categories: malicious cyberattack, theft or mistake, and unauthorized access. The report says financial information was the most common type of information compromised for the third year in a row.
Ferguson said the 3.4 million people affected is up by 700,000, or 26 percent, over the year before. Nearly half, 49 percent, of all data breaches were the result of cyberattacks, the Data Breach Report states.
In the report, Washington state defines “personally identifiable information” as the combination of a first name or first initial and last name, with one or more of the following: a social security number, driver’s license number, or financial account numbers.
Washington law requires the Attorney General’s Office to be notified of any breach impacting more than 500 people.
Ferguson points out that the current law does not require notification to his office if a hacker obtains a person’s email address and password, tax ID number, passport number, health insurance policy number or DNA profile.
Ferguson says he will introduce legislation next year to make the following improvements to strengthen Washington’s data breach notification law:
- Reduce the deadline to notify affected individuals of a breach to 30 days after the breach is discovered;
- Require preliminary notification to the Attorney General’s Office of a breach within 10 days after the breach’s discovery; and
- Expand the definition of personally identifiable information to include full dates of birth, usernames in combination with passwords, digital signatures, DNA profiles or other forms of biometric data, and identification numbers from passports and other sources.
