More than half (55%) of phishing attacks target IT departments, according to research commissioned by OpenText. Additionally, nearly half of survey respondents said they had fallen for a malware phishing attack.
“The most common form is a standard untargeted mass phishing attack,” the researchers write. “Nearly one in five of the respondents to the IDG survey said they either were definitely targeted by such an attack (37%) or suspect they were (42%). Next most common is a malware attack, where the user gets an email with an attachment — usually a Microsoft Office document — that launches malware if clicked on. Among the respondents, 44% confirmed they were the victim of such an attack and 23% suspect so.”
Many respondents also said that malware phishing attacks are very hard to identify.
“Malware attacks joined search engine phishing and clone phishing as the most difficult types of attacks to recognize and avoid, all cited by around one-third of the respondents,” the researchers write. “Search engine phishing involves fake websites that show up in search engine results, including in paid ads. Often posing as some type of financial institution, the sites then entice users to enter personal information, including banking credentials.”
The report found that the consequences of phishing attacks range from data breaches, lost revenue, downtime, legal troubles, and reputational damage.
“More than a third (37%) cited exposure of sensitive data, and 32% said they’ve suffered lost productivity,” the researchers write. “One in five had suffered a loss of revenue from phishing, and nearly as many (19%) had had to pay legal or regulatory fines. Perhaps worse, more than one-third (37%) reported that their organization had suffered downtime lasting longer than a day as a result of phishing attacks. Larger organizations (500 to 999 employees) were far more likely to report such downtime, at 44%, versus 14% for small companies (25 to 100 employees). Larger organizations are also more likely to report negative consequences from phishing, especially exposure of sensitive data: nearly half (49%) of all the respondents from large companies, versus 35% for medium (100 to 499 employees) and 16% for small companies.”
New-school security awareness training can give your organization an essential layer of defense by enabling your employees to recognize phishing attacks.
