What’s supercharging data breaches?

0:01NPR.

0:11This is The Indicator from Planet Money. I'm Waylon Wong. And I'm Cooper Katz McKim, a producer on the show. Okay, Waylon, we've talked about the dark web before. Yes, it's part of the internet where people go to do all kinds of illegal business. So it sounds scary, but you know, I wanted to actually see what it looks like. Is it all just like a black background with red text kind of thing? So I checked in with Michele Campobasso, a cybersecurity expert in Italy, and he actually took me there, specifically to this ransomware site. What they do is that they have this kind of blog where they post notices for their victims with a countdown of, if you don't pay us by the end of the countdown, we are going to release data.

0:54And what he showed me were these caches of data of high schools, of hospitals, of entire cities that have lost their data because they didn't pay some ransom. This is one example of how data is breached. There's also malware, deepfake fraud, the big corporate breaches you hear about in the news. And all of it is happening for the purpose of extracting value from your information. It's a very flourishing market. It works. It just works. This week on The Indicator, we're bringing you a special series on the evolving business of crime. When it comes to data breaches, that evolution has been supercharged.

1:30So today on the show, we look at how that's happening and why you don't have to be a hacker anymore to get into the game.

1:41This message comes from Vanguard. Capturing value in the bond market is not easy. That's why Vanguard offers a suite of over 80 institutional quality bond funds, actively managed by a 200-person global team of sector specialists, analysts, and traders. They're designed for financial advisors looking to give their clients consistent results year in and year out. See the record at Vanguard.com slash audio. That's Vanguard.com slash audio. All investing is subject to risk. Vanguard Marketing Corporation Distributor. This message comes from Dell Technologies. Your new Dell PC with Intel Core Ultra helps you handle a lot when your holiday to-dos get to be a lot.

2:25Luckily, the Dell PC helps you get it all done. Get yours at dell.com slash holiday. This message comes from Warby Parker. Prescription eyewear that's expertly crafted and unexpectedly affordable. Glasses designed in-house from premium materials starting at just$95, including prescription lenses. Stop by a Warby Parker store near you. Okay, Waylon, picture this. You're in your kitchen, morning light, beaming through the window, plants getting fed. You open a newspaper and there's a big headline, data breach. AT &T sees phone records of nearly all customers stolen. And you're wondering, am I a part of that?

3:04Well, I'm an AT &T subscriber, so probably. And if you want to know for certain if your data was gobbled up, Troy Hunt may be able to help you. I started the data breach search service. Have I been pwned? He said pwned. Okay. I've always wanted to know how that was pronounced because I only ever saw it. spelled P-W-N-E-D, right? Yeah, looks kind of like gibberish. And it actually is gibberish because it comes from a misspelling of the word owned from the video game world. So when someone's data has been stolen, they've been owned, I guess, or pwned. Right. So Troy's company is based in Australia.

3:42It's actually a free service that he offers to anyone around the world. Whenever there's a breach, Troy finds the public information and indexes it on his website to let people know if they've had their data stolen. This, unfortunately, happens a lot because data breaches happen a lot. Well, look, I'm receiving data every single day. On average, I would receive multiple data breaches a day. It's a little bit of one of those tip-of-the-iceberg sort of scenarios. We've got 15 billion breached records in Have I Been Pwned, and I'm quite sure that that would be somewhere in the order of 10 % of the total number that have occurred over the course of time.

4:15One in five people living in the U.S. have been targeted with malware that steals their information. According to one estimate, in an eight-month period, cybercriminals made$140 million in revenue from selling stolen data products alone. So, yeah, cybercriminals clearly value your information and are getting it. Okay, Cooper, I'm going to put my personal email into Have I Been Pwned to see if I'm one of those one in five. I'm curious. Yeah, let's find out. Okay, here we go. Oh, 26 data breaches. Okay. It says, oh, no, pwned. This email address has been found in multiple data breaches. So I scroll down.

4:54Oh, Neiman Marcus. That was the last time I shot at Neiman Marcus. That was something Troy was saying, actually, was that sometimes it just shows up in random things because other data breaches lead other data breaches. This is all very demoralizing. I know. We're learning a lot of value. It's like it's almost like this information shouldn't be made public. Oh, OK. So like one of my credentials that has been compromised is for MyFitnessPal, which I don't even remember the last time I logged in or used it or anything. And I don't think that's necessarily that valuable. But it's like cyber criminals just want a bazillion passwords and then hope one of them leads to something of value.

5:31That password is one key in a metaphorical pile of keys. Criminals don't know where they lead, but they're willing to try every house and car in the neighborhood until they find something that works. For instance, maybe my MyFitnessPal password is the same as my bank password. Yes, hopefully not. Nope, it's not. Don't even try it. Do not try it. But look, this market is growing. The U.S. is already on track for a record year in data breaches in 2025. So it's not actually easy to quantify just how many data breaches there are because they're often not reported. But experts agree they've gone up.

6:05Between 2023 and 2024, the cost in the U.S. of a data breach has actually increased nearly 10%. The reason this market is moving like a freight train is because it's hard to protect against. Bad actors are adjusting very quickly. Stuart Manick is a professor at the MIT Sloan School of Management and the founding director of cybersecurity there. I often say the good guys are getting better, but the bad guys are getting badder even faster. So how are they doing this? Stuart says one way that cyber criminals are staying ahead of the curve is AI. We've seen several examples of how cyber attacks have been greatly accelerated due to AI tools.

6:43A study by IBM found 16 % of data breaches now involve AI. Another found that 80 % of all ransomware attacks have been accelerated because of it. Stewart tells us it changes every aspect of cybercrime because data collection tasks just become easier. And you might think this is just for bulk breaches. Like recently we saw Ticketmaster or TransUnion. But AI can even help with higher effort individual crimes. Take spear phishing. This is a kind of hyper-focused cybercrime where you learn as much as you can about someone, and then you pretend online to be their trusted colleague or boss or partner, and you impersonate that person and you ask for your login info or to transfer some money.

7:24That takes time and effort. Guess what? AI systems can do that splendidly, much faster, and in many cases, higher quality. And not only that, he says AI offers another advantage, franchising. Hackers are finding what works and then just selling it to other people. Once I built a tool to do that, it's kind of easy to say for$10 ,000 or 50 % of the gain, here, I will give you this tool so there's a multiplying effect going on on the bad guy world. Yeah, while once upon a time the dark net was just full of products like credit card and social security numbers, there are now more services for sale.

8:02It's allowing cybercriminals without a technical background to get into the game, too. Anyone can, for example, pay a subscription to license a top-notch malware service. Franchising also helps criminals because it means they're actually sharing knowledge and collectively learning from it, which they are distinctly better at than their victims. Cybercriminals are learning faster and adjusting faster. Big companies could certainly learn from other data breaches, but oftentimes they're not desperate to share that they've been hacked. It's bad for publicity. It raises all kinds of legal issues. It encourages copycats.

8:36Meanwhile, cybercriminals benefit from sharing that information. The bad guys have huge egos. And number two, they sell the information. So I can say, hey, I'm the one who shut down Capital One. And for$10 ,000, I'll tell you how you can do it to another bank. Stuart, what are you admitting to us? Calls coming from inside the house. Stuart's been to a lot of conferences lately, and he keeps asking rooms full of people if they think the cybersecurity situation will be better, worse, or the same in 10 years. 90 % say it'll be worse than today. Doesn't mean we're not going to try to hold back the tide, but the tide is rising against us.

9:14There are plenty of ways to protect yourself. Keep your systems updated, use two-factor authentication, and don't repeat passwords. You know, but ultimately experts tell us it's unrealistic to expect individuals to be the ones to go up themselves against these cybercrime syndicates. I mean, it's not reasonable. Governments, businesses, and academics, in some experts' opinion, they need to come together to create a more robust solution here. So stay wary. If your boss suddenly asks you to send over 10 grand, maybe double check. Tomorrow, we're bringing you another episode of the Vice series. This one details how the drug trade is wreaking havoc on the environment.

9:53This episode was produced by Corey Bridges with engineering by Sina Lafredo. It was fact-checked by Sierra Juarez. Kagan Cannon edits our show and the indicators of production of NPR. Yeah, speaking of Waylon, could you send me 10 grand? This is not a tip. Oh yeah, sure. What's your Venmo? Oh, perfect. Okay, it works. This message comes from the Council for Interior Design Qualification. Interior designer and CIDQ president Siavash Madani explains the value of having an NCIDQ certification. An NCIDQ certified interior designer must complete a minimum of six years of specialized education and work experience and pass the three-part NCIDQ exam.

10:33All three exams emphasize and focus on health, safety, and welfare of the occupants. It's really about the implementation of design. Good design is never just about aesthetics. It's about intention, safety, and impact. We take the responsibility of protecting the public seriously. The space needs to be functional, safe, and accessible. To learn more about NCIDQ certification or to hire a certified designer, visit cidq.org slash NPR. This message comes from Capital One. The Capital One VentureX Business Card earns unlimited double miles on every purchase. Capital One, what's in your wallet? Terms and conditions apply.

11:16Find out more at capitalone.com slash VentureX Business. business.