Various Errors (42%), web application attacks (29%) and cyberespionage (13%) top the list of data breach causes for organizations — public and private — that deal with “the creation, transmission and storing of information,” including of TV shows and movies.

That’s according to Verizon Communications’s 2019 Data Breach Investigations Report a review of data from 41,686 security incidents* and 2,013 data breaches** from 73 different sources. The goal, the report said, was to provide perspectives on threats “organizations like yours face.”

Verizon’s review found that a third of those threats (actually 34%) were internal, including misuse by authorized users and errors.

In the interests of better cyber-hygiene — have you scrubbed behind your virtual ears? — The Wire presents some of Verizon’s key takeaways:

1. Aiming for the top. C-suite execs are being increasingly targeted, with incidents rising from single digits in the previous report to dozens in the latest.
2. Threatening cloud. As companies transfer data to the cloud, stolen credentials are the method of choice for hacking those remote email servers.
3. Sorry, right number. Web-based payment card number theft is on its way to exceeding those from physical terminals, which may be a case of chip-and-pin card technology better protecting physical transactions.
4. Your money or your online life. Ransomware accounts for about a quarter of all malware-related incidents.
5. HR breathes easier. Attacks on human resources personnel have decreased, correlating with the virtual disappearance (pun intended) of W-2 tax form scams from the survey.
6. Not-so-smartphones. Mobile users are more susceptible to click on test phishing e-mails, in part because of the user interface.

* Incident: A security event that compromises the integrity, confidentiality or availability of an information asset.

** Breach: An incident that results in the confirmed disclosure — not just potential exposure — of data to an unauthorized party.

Cox Communications said it is investigating the possible theft of personal information about its employees after a listing appeared on a so-called dark Web site advertising access to email addresses, phone numbers and other information for 40,000 employees of the cable, phone and Internet provider.

The company released a statement late last week -- after the apparent breach was reported on by Vice's Motherboard site -- saying: "Cox Communications is aware of this matter and the business-related information to which it relates. The listing did not include any residential customer data. We’re taking this very seriously and have engaged a third-party forensic team to conduct a comprehensive investigation and are actively working with law enforcement. Cox’s commitment to privacy and data security is a top priority for the company." 

[RELATED STORY: Wheeler's FCC expected to take up broadband information-privacy measure as soon as this month.]

Motherboard reported it obtained a small sample of the data for verification purposes and shared it with Cox.

Cable companies' customers have been a target for data hacks, including recent ones affecting Comcast and Time Warner Cable. Cox in November 2015 agreed to pay a $595,000 settlement with the FCC Enforcement Bureau for failing to "properly protect" customer data related to a 2014 hack by "EvilJordie" of the "Lizard Squad." But this most recent apparent hack did not involve residential customer information, Cox said.

WASHINGTON — The U.S. Office of Personnel Management on Thursday (July 9) increased the total number of current and former federal employees — as well as spouses, partners and those who tried but failed to get a government job — affected by two separate data breaches to more than 25 million.

According to an update on the two cybersecurity breaches, the OPM said that while investigating the theft of Social Security numbers, addresses and other information on 4.2 million people, it discovered last month that sensitive information from an additional 21.5 million people, who had supplied data for background checks, had had their personal information stolen.

The good news is that apparently no health or financial records were affected. The other good news is that, at least to date, the OPM said there is nothing to suggest the stolen information has been misused.

Those highly likely to have been affected include everyone who underwent a background check investigation dating from 2000, and perhaps even before, though that is less likely, the OPM said.

At about the same time the OPM was releasing its new and newly troubling figures, bipartisan leaders of the House Energy & Commerce Committee requested info from the Federal Trade Commission and Consumer Financial Protection Bureau on consumer protections following data breaches.

“It may be possible to streamline the process to reduce fraud following a breach. Therefore, we are writing to learn more about consumer-friendly post-breach protections, including whether the process of activating and inactivating a credit freeze can be made more efficient and less costly,” the lawmakers said.

They also want a briefing from each agency by July 20.

Signing on to the letter were the Energy and Commerce Committee chairman Rep. Fred Upton (R-Mich.) and ranking member Rep. Frank Pallone, (D-N.J.); Commerce, Manufacturing, and Trade Subcommittee chairman Michael C. Burgess (R-Tex.) and ranking member Jan Schakowsky (D-Ill.); and Oversight and Investigations Subcommittee chairman Tim Murphy (R-Pa.) and ranking member Diana DeGette (D-Colo.).

Sen. Ron Johnson (R-Wis.), chairman of the Senate Committee on Homeland Security and Governmental Affairs,was not pleased with the news. “The OPM has finally confirmed what the news media and the FBI have been saying about the data breach for the past month — this unprecedented hack was over six times what we were initially told," he said in a statement. "Today’s announcement shows not only that cybersecurity on federal agency networks has been grossly inadequate but that the management of the OPM is not up to the task of fixing the problem. The agency and the administration have not even been able to correctly define the scope of the problem. This will have grave consequences for national security.”