Data and information theft

Data and information theft is the crime of stealing data because the data itself is worth something, and it is one of the main reasons a system is attacked. The attacker is not trying to prove they can break in — they want the records held on the system, because those records can be used or sold. Details that point to a real person are the most wanted, since they can be turned into fraud.

A record only has to link a few facts about you to be useful: enough for a criminal to open an account, pass a security check or spend money in your name. Single records are worth little, so stolen data is traded in bulk on a black market, where criminals buy and sell files of records. The person who took the data may never use it; passing it on is the whole point.

Data theft often leads to two other crimes:

• Identity theft — someone uses another person's details to pretend to be them, for example to open accounts or take out credit. The victim usually finds out only when a bill or a refused loan arrives.
• Extortion — stolen data is used to pressure a person or an organisation into paying money. The attacker threatens to release what they hold unless they are paid, so the data is blackmail material.

For example, a tennis club stores details of players, parents and volunteers so it can collect fees. An attacker copies the whole database. One buyer uses a parent's details to take out a mobile contract in that parent's name, which is identity theft. Another buyer emails the club with a page of the records and threatens to publish the lot unless £2,000 is paid, which is extortion. Both crimes harm the people in the records as well as the club.

The aim here is to get hold of the information, not to stop the service running. An attack that mainly stops normal operation is a disruption attack, a separate reason for attacking a system.