PII covers information that identifies people, making its collection, storage, and disclosure central to privacy protection and breach response.
Search across headline titles and summaries.
Background for this topic.
PII (personally identifiable information) is information that identifies a person directly or can do so when combined with other data. Direct identifiers include names, government identification numbers, passport details, and email addresses; indirect identifiers can include birth dates, precise location, or unique account attributes. The term is used broadly in security, but its legal scope varies: laws and regulations may use different definitions, such as “personal data” under the GDPR or protected health information under HIPAA.
PII is a high-value target because unauthorized access or disclosure can enable identity fraud, targeted phishing, or privacy harm. It may be exposed through compromised applications, cloud storage, logs, endpoints, or third parties. Practitioners should inventory and classify it, collect and retain only what is needed, restrict access, and protect it with encryption or tokenization where appropriate. Monitoring and tested procedures for investigating exposure are important, while retention, deletion, and notification duties depend on the applicable jurisdiction and sector.
Why was PII belonging to nearly 1 billion people housed in a single, open database? Why didn't anyone notice it was downloaded?
The Federal Communications Commission (FCC) warned Americans of an increasing wave of SMS (Short Message Service) phishing attacks attempting to steal their personal information and money. [...]
Oops, did the Un-carrier under-count by 29m punters? T-Mobile US has agreed to pay about $550 million to end legal action against it and improve its security after crooks infiltrated the self-described Un-carrier last summer and harvested personal data belonging to almost 77 million customers.…
And yes, Musk is back in the headlines, denying another affair Twitter is investigating claims that a near-seven-month-old vulnerability in its software has been exploited to obtain the phone numbers and email addresses of a reported 5.4 million users. …