The Impact of Aggregated Leaks on Privacy (SA)

Privacy is in a constant battle with economic, scientific and security interests. In our modern world enormous amounts of personal and identifying information about us is collected and analyzed. While significant resources are allocated to regulate this industry, criminals are not bound by such limitations.

The exploitation of illegally obtained information is already estimated to be a billion dollar industry and its growth has not plateaued yet. In order to be ready for the ever increasing capabilities of cyber criminals it is crucial to examine the challenges that await.

This paper studies network effects emerging from the aggregation and linkage of illegally obtainable personally identifiable information. We achieve this by analyzing a synthetic dataset which represents over 600 distinct data leaks that resulted in the exposure of over 12 billion records.

We show the effectiveness of mitigation strategies such as using different email addresses and introduce User-Initiated Differential Privacy as an effective defense, reducing the risk of link discovery by up to 50%.