50% of organizations surveyed were victims of spear phishing attacks in the last twelve months, according to a new report from Barracuda. The report also found that, on average, organizations receive five “highly personalized spear phishing emails per day.”
“In an analysis of 50 billion emails across 3.5 million mailboxes, Barracuda researchers uncovered nearly 30,000,000 spear phishing emails,” the report states. “While these emails make up less than 0.1% of all emails sent, they greatly impact organizations when attacks are successful. (For comparison, high-volume attacks, such as spam and malware, make up about 16% of emails, but their impact is not as high.) The average cost of a data breach caused by business email compromise was nearly $5 million in 2022, according to IBM. And no business is immune.”
The researchers found that while spear phishing makes up a very small percentage of email attacks, it’s responsible for a majority of successful breaches.
“Three-quarters of respondents surveyed said they fell victim to an email attack in the last 12 months. Half said they were the victims of spear phishing,” the report says. “That means 2 out of 3 successful email attacks are spear phishing attacks that use personalized messages, social engineering, and other tactics. This is significant because these attacks make up only 0.1% of all email-based attacks according to Barracuda’s data but are responsible for 66% of all breaches. On the other hand, high-volume attacks such as spam and malware, make up 16% of emails but are only responsible for one-third of breaches. Spear phishing protection is critical because even just one successful attack can be devastating.”
Almost all the organizations that fell victim to spear phishing suffered adverse effects.
“Nearly every victim of a spear phishing attack in the last 12 months saw impacts on their organization, including malware infections, stolen data, and reputational damage,” the researchers write. “While a direct monetary loss is one of the effects, all the other impacts could also result in some financial damage for an organization as a result of an attack.”
New-school security awareness training can enable your employees to thwart targeted social engineering attacks.
