Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How often do websites (and their databases) get hacked? Hacked as in user accounts stolen, tables flushed, and all in all, damage done to the database.

I'm talking about e-commerce websites, and moreover, anything besides major financial institutions because I always hear about those hacks on the news.

share|improve this question

migrated from Jul 25 '11 at 3:44

This question came from our site for professional programmers interested in conceptual questions about software development.

What are the chances I'll have a car accident? – delnan Jul 24 '11 at 17:34
Security isn't a question of probability, it's something you should be prepared for no mater how secure you think your website is. Do backup, use proper cryptography for sensitive data, etc. – HoLyVieR Jul 24 '11 at 17:42
@delnan 50/50 - either you will or you won't. ;) – Anna Lear Jul 24 '11 at 17:49
Quite a few people die at railway crossings without barriers because they've decided, from experience, that there's (almost) never a train. Per-whatever odds often mislead in the long-term. Don't ask "will it happen", ask "how often". And the answer is probably "often enough that you need to plan for it". – Steve314 Jul 24 '11 at 18:55
Security is much more like insurance....The higher the "cost" generally the better the protection/coverage. There is some probability involved based on how much protection you have provided. – mdpc Jul 25 '11 at 4:20
up vote 9 down vote accepted

Even if such a statistic existed, it would be meaningless because these attacks don't occur as a result of random chance.

Your chances of being "hacked" rise dramatically if:

  • You don't secure the application properly (SQL Injection being the most obvious, and sadly still commonplace vulnerability; others include plain-text passwords, XSS/XSRF, and not validating form/query string inputs);

  • You don't secure the site properly (e.g. you allow directory listings, allow anonymous FTP access, don't chroot the FTP, etc.)

  • You don't secure the network properly (e.g. you run services under privileged accounts, don't set up proper ACLs or firewall rules, etc.), which would make it far easier for an attacker to scan for vulnerabilities and find some means of privilege elevation.

  • You have a large and/or poorly-trained staff working on the system, increasing the odds of a random social engineering attack being successful.

  • Your site is high-traffic, high-revenue, high-sensitivity, or otherwise represents a high value to attackers, which implies a greater likelihood of a targeted social engineering or similar attack (i.e. espionage).

If you secure your environment and your applications properly, you have very little to worry about as long as you don't paint a big target sign on your back. Once you get to that size, you should be hiring a full-time IT security consultant who will ensure that the odds of you being "hacked" are very close to zero, and/or that the actual business implications of such an occurrence would be minimal.

share|improve this answer

How often do websites (and their databases) get hacked?

It is generally unknown, and potentially unknowable.

Many countries do not have computer crime laws[1]. In the United States the laws vary from state to state. 48 states have passed computer crime legislation.[2] Even in locations that have computer crime law, the victims don't often report it.

I recently asked about Resources for data on security incidents to do some research on the subject. Some database contributers submit their data on condition of anonymity.

It may be possible to find statistics on certain classes of website who are legally required to report exposure of personal information. However even among those who are legally obligated to report, some may be unaware of the law and some may choose not to report anyway.

anything besides major financial institutions because I always hear about those hacks on the news.

Well, you hear about the sensational ones anyway. I'm sure there are plenty of incidents at major financial institutions that do not receive significant media coverage. Aparently Belgium, France, and Netherlands have no legal reporting requirements. [3] So, theoritically a major breach could have happened to a major financial institution in those countries and we might never hear of it.

[1]Fundamentals of network security, Eric Maiwald

[2]Laws as Tools for Computer Security

[3]International Security Breach Notification Survey

share|improve this answer

This question warrants more attention than what it has been given. The OP, perhaps unknowingly so, have identified the Achilles heel of information security, namely accurately determining the probability of a threat being realized.

Granted it would impossible to answer the question without first qualifying the party asking but this question underlies, or at least should underlie, every single security decision made. The answer to this question shouldn't be squirming and awkward silence. We should be able to answer these types questions without hesitation.

Collectively, as an "industry", we've failed miserably at providing our clients with this vital data. Worse still - we've allowed it's importance to be dwarfed by fear, uncertainty, doubt and clever marketing ploys.

Like any other mature industry we should be supported by data that has been analyzed, interpreted, refined, modeled and systematized. Luckily there are a few initiatives that attempt to collect data, but collecting is only part of the solution. The real problem lies within interpreting the data and understanding relationships between sets of data.

Unless we choose to acknowledge that this is a problem there is little hope for the security "industry" to ever reach adulthood and instead we'll be stuck in this pubertal wasteland of lies and deceit.

TLDR; Unfortunately we cannot provide you with an accurate answer due to lack of supporting data. What we can do however is wave our hand in an undefined direction suggesting that an attack is likely to occur where there is low-hanging fruit. There are many types of attackers with various motivations, capabilities and resources.

If you're the victim of a targeted attack you're unlikely to have sufficient protection, just deal with it. If however your attacker is of a more "opportunistic" type and you've failed to cut your low hanging fruit, it is ... probable that he'll find you, and successfully do whatever it is that he decides to do.

share|improve this answer

The chances are high enough to actively diminish the possibility of a security breach.

If it can happen, you need to plan for it as if it will happen. That way when it does, nobody will be staring at you wondering why you didn't defend against it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.