Apple study shows 2.6bn personal records compromised by data breaches in past two years

More than 2.6 billion personal records have been compromised by data breaches in the past two years, highlighting the need to enhance guardrails in user devices, a new study from Apple shows.

Around 1.1 billion and 1.5 billion breaches occurred in 2021 and 2022, respectively, contributing to the tripling of these incidents between 2013 and last year, the iPhone-maker said in the report conducted in collaboration with the Massachusetts Institute of Technology.

In the US alone, the number of data breaches rose by nearly a fifth in the first nine months of 2023, compared to the entirety of 2022, it said.

These, they said, highlight the need for more stringent protections, most notably end-to-end encryption, the system in which only those communicating with each other can see the messages being sent.

“Organisations must rethink the amount of data they collect and, especially, limit the amount of unencrypted consumer data they retain. It’s also why, in the last year, technology platforms and other industry players have expanded their use of end-to-end encryption,” the study said.

End-to-end encryption uses an algorithm that transforms standard text characters into an unreadable format. It uses encryption keys to scramble data so that only authorised users can read it.

The origins of E2EE, as it is also referred to, stretch back to the 1970s, but it gained attention with the emergence of WhatsApp, which touted the key privacy feature. In 2014, Meta, then known as Facebook, bought WhatsApp for $19 billion.

The most obvious reason is that it guarantees the security and privacy of content being shared between users.

But this isn’t only limited to regular users: businesses can also largely benefit from E2EE, as it can protect sensitive data and information, such as financial and legal documents.

The Apple-MIT study noted that technology companies are increasingly boosting their ecosystems’ security by rolling out several encryption features.

California-based Apple – known for its stringent security on its software and devices – in 2011 made its iMessage the first widely available messaging service to provide E2EE encryption by default. It also rolled out Advanced Data Protection for iCloud in December 2022.

In February this year, Alphabet’s Google expanded client-side encryption to include additional Google Workspace products such as Gmail and Calendar.