2021 Set New Record For Data Breaches, Ransomware Attacks In WA

OLYMPIA, WA — It was a banner year for hackers. Unfortunately, that means it was a painful one for everyday Washingtonians.

Every year, Washington Attorney General Bob Ferguson and his team tally the number of data breaches and ransomware attacks targeting Washingtonians for their annual Data Breach Report. This year's report was released Friday, and found that Washingtonians saw a record-breaking spike in data breaches in 2021.

“We publish this report because Washingtonians are best able to safeguard their data when they are aware of the threats — and the threats have never been greater,” Ferguson said.

According to the sixth annual Data Breach Report:

Businesses and agencies sent a whopping 6.3 million data breach notices to Washingtonians

For context, there are only 7.7 million Washingtonians in total, according to the 2020 census. The Attorney General's Office says 6.3 million is by far the most data breach notices they've seen: the old record was just 3.5 million notices, set back in 2018.

The number of data breaches more than tripled the old record, and nearly quintupled versus 2020

Last year, Washington was subjected to 60 unique data breaches or ransomware attacks. That's relatively standard, considering that, at the time, the record high number of attacks was 78.

In 2021, that number ballooned into 280 unique breaches. That's a massive jump, and one the Attorney General's Office blames on a "tremendous spike" in cyberattacks and ransomware incidents. Cyberattacks accounted for 87.5 percent of 2021's reported data breaches, up from 63 percent in 2020, the AGO said. More than half of those cyberattacks involved ransomware.

For the unfamiliar, a ransomware incident is one in which hackers hijack a collection of data and threaten to release it publicly, unless the data's rightful owners pay a ransom. One higher-profile ransomware attack this year happened in Lakewood's Clover Park School District, who completely lost their old website to hackers when they refused to pay up.

Washington logged its first "mega breach" in years

A mega breach, according to the Attorney General's Office, is a breach that impacts over 1 million people. Washington hadn't seen a mega breach since 2018, but saw one in 2021 courtesy of the hackers who broke into Accellion's file-sharing technology, compromising the personal information of about 1.3 million Washingtonians.

Several factors likely lead to the spike in data breaches

Perhaps unsurprisingly, the Attorney General's Office says the dramatic increase in data breaches is likely directly linked to the COVID-19 pandemic and work from home protocols.

"During the COVID-19 pandemic, Washingtonians are increasingly relying on digital and online services that collect user data to conduct business, go to school, find entertainment and communicate with friends and family," the agency said. "This increase in online activity may create more opportunities for cybercriminals to steal personal information and underlines the importance of Washington’s data breach notification laws."

Another factor that helped drive the numbers up was hacks that targeted large data processors like Blackbaud and Accellion. Breaking into one of those vaults provided hackers with the data of hundreds of organizations, driving a 200 percent increase in the number of breaches impacting 50,000+ Washingtonians.

Finally, better reporting tools also helped juice the stats. In 2019, Washington updated requirements for breach notices, expanding the number of breaches covered by state law and requiring companies to issue more comprehensive updates to consumers.

>> Read the full report from the Attorney General's Office.