Headlines announcing arrests of hackers and cyber-thieves from groups like Anonymous and LulzSec create the illusion that the good guys are winning the battle to secure the online world. But corporate boards of directors who think their company’s data is secure are probably fooling themselves, and many are ignoring cyber-risk management altogether.

The worldwide arrests in the last week have netted suspected members of hacking networks that have breached corporations and government agencies—including targeted digital break-ins at Visa, Sony, and MasterCard—that have affected up to one million people along the way. Yet company boards in the Forbes Global 2000 are still largely overlooking the threat of these cyber risks, says a new report from Carnegie Mellon University’s CyLab [PDF].