The report provides unique insights into how the COVID-19 pandemic affected the data breach landscape
Verizon has released the 14th installment of its annual Data Breach Investigations Report (DBIR) that analyzed 5,258 confirmed data breaches, an increase from 3,950 in the report’s previous issue. As might be expected, the 2021 edition, which used input from 83 contributing organizations from around the world, also sheds unique light on the impact that the COVID-19 pandemic has had on the data breach landscape.
With a sizeable part of the workforce forced to work remotely, the pandemic-powered transition has been mirrored by the increase in certain types of cyberattacks. Phishing attacks, a persistent and most acute threat for years, saw an increase by 11%; meanwhile, the number of ransomware attacks grew by 6% compared to the year prior. A total of 85% of breaches involved a human element.
“This increase correlates with our expectations given the initial rush in phishing and COVID-19-related phishing lures as the worldwide stay-at-home orders went into effect,” reads the Verizon 2021 Data Breach Investigations Report.
Indeed, throughout the pandemic, COVID-19-themed phishing attacks have been popping up left and right. Initially, threat actors tried to dupe victims by impersonating the World Health Organization (WHO); however, more recently, they adapted their tactics and tried to cash in on the distribution effort with various vaccine scams.
With an increasing number of businesses taking steps toward digital transformation and transitioning more of their operations to the cloud, the report also examined the challenges they face along the way and found that attacks on web applications represented 39% of all breaches.
“As the number of companies switching business-critical functions to the cloud increases, the potential threat to their operations may become more pronounced, as malicious actors look to exploit human vulnerabilities and leverage an increased dependency on digital infrastructures,” Verizon Business CEO Tami Erwin said in a press release.
The report also carried out an analysis of 12 different industries and found that while all of them face cybersecurity challenges, these differ from industry to industry based on various aspects, ranging from their infrastructure to the type of data they handle. Personal data accounted for 83% of data compromised in the financial and insurance industries, whereas in the scientific and technical services they made up “only” 49% of all breached data.
The most significant threat to the public administration vertical is social engineering attacks, which were behind 69% of the breaches. Unsurprisingly, the retail industry is predominantly targeted by financially motivated threat actors looking to make a pretty penny by obtaining payment cards and personal information.
