New Verizon DBIR: Credentials Stolen in 85% of Social Engineering Breaches

Verizon’s latest data breach report puts a spotlight on one of the largest and most unpredictable risk factors in your cybersecurity strategy – your users.

This year’s Verizon Data Breach Investigations Report (DBIR) is out and it chock full of great data around what kinds of threat actions are involved in data breaches, who’s being attacked, and what are the impacts.

One of the recurring themes in this year’s report is the role the user plays in attacks. As seen in this blog’s title, the human element is significant in data breaches – whether the user is malicious, negligent, or accidental, humans are almost always the cause of a cyberattack. And this appears to be equally true in the case of data breaches.

According to the report:

• Phishing is the number one threat action, involved in 36% of breaches
• Approximately one-third of data breaches involve social engineering
• Public Administration, Utilities, and Education had the highest number of breaches involving people (with a direct correlation to the use of social engineering)

And these attacks appear to have very real ramifications:

• In 85% of social engineering breaches, stolen credentials are the result
• More than 60% of attacks involving social engineering involve malware infection
• Ransomware is the third highest threat appearing in breaches

The good news is the report isn’t all doom and gloom; interestingly, the new DBIR reported on the effectiveness of phishing testing on user click rates. According to the report, the median click rate in phishing simulations is only 3%!

Think about how important this is when combined with Security Awareness Training and a layered security strategy: solutions at each layer hopefully block a material percentage of attacks (think email scanning, endpoint protection, etc.) with a very small percentage actually reaching the user’s Inbox. Then with Security Awareness Training and phishing testing, users only click on 3% of the already small percentage of all attacks, reducing your threat surface even more.

Note though that 3 billion phishing attacks are sent every day, so even a small percentage making it through is still tens of millions being active phishing threats. 

Data Breaches are now a part of over 70% of all ransomware attacks as well, so they aren’t going anywhere anytime soon. Put a layered defense in place that includes patching your code, filtering email, protecting the endpoint, and training your users and you will see a significant reduction in your risk of successful data breach.