Costly Oversights

Board Responsibility & Liability

• Law

Given new governmental regulations, many Boards of Directors now take a very active interest in cybersecurity. They want to know about current and evolving risks, as well as the organization’s security preparedness and response plans. The financial impact of a cyberattack can be significant and can include costly class-action lawsuits, which may reflect on Boards’ fiduciary responsibility to preserve corporate financial value.

Noteworthy hacking statistics

1. The average cost of a data breach was $4.88 million in 2024, the highest average on record. (IBM)
2. 88% of cybersecurity breaches are caused by human error. (Stanford)
3. The average time to identify a breach is 194 days. (IBM)
4. The average lifecycle of a breach is 292 days from identification to containment. (IBM)
5. The likelihood that a cybercrime entity is detected and prosecuted in the U.S. is estimated at around 0.05%. (World Economic Forum)
6. 68% of breaches involved a human element in 2024. (Verizon)
7. In 2022, the Federal Trade Commission received more than 1.1 million reports of identity theft (US News)
8. In 2023, security breaches saw a 72% increase from 2021, which held the previous all-time record. (Forbes)
9. Cyber fatigue, or apathy to proactively defending against cyberattacks, affects as much as 42% of companies. (Cisco)
10. 64% of Americans have never checked to see if they were affected by a data breach. (Varonis)
11. The U.S. was the target of 46% of cyberattacks in 2020, more than double any other country. (Microsoft)
12. 56% of Americans don’t know what steps to take in the event of a data breach. (Varonis)
13. 97% of organizations have seen an increase in cyber threats since the start of the Russia-Ukraine war in 2022. (Accenture)

Historic data breaches

1. Over 560 million Ticketmaster customers had their information stolen in a 2024 breach. (BBC) 
2. A 2021 LinkedIn data breach exposed the personal information of 700 million users or about 93% of all LinkedIn members. (RestorePrivacy)
3. An attack on Microsoft in March 2021 affected more than 30,000 organizations in the U.S., including businesses and government agencies. (Microsoft)
4. In April 2021, a two-year-old vulnerability was discovered that exposed the personal information of more than 533 million users. (Auth0)
5. Using a single password, hackers infiltrated the Colonial Pipeline Company in 2021 with a ransomware attack that caused fuel shortages across the U.S. (Bloomberg)
6. Meat processing company JBS was the victim of a ransomware attack that shut down beef and poultry processing plants on four different continents. (Wall Street Journal)
7. In 2023 T-Mobile disclosed its second data breach of the year involving the theft of 836 customers' personal data, the first data breach affected approximately 37 million customers. (itgovernanace)
8. In September 2021, Neiman Marcus found an 18-month-old data breach that exposed payment data and other information for 4.6 million shoppers. (Neiman Marcus)
9. Personal data belonging to more than 100 million Android users was exposed in a 2021 data leak due to misconfigured cloud services. (Check Point)
10. Trading app Robinhood fell victim to a social engineering attack that compromised the personal data of 5 million users. (Robinhood)
11. A 2020 Twitter breach targeted 130 accounts including those of past U.S. presidents and Tesla CEO Elon Musk, resulting in attackers swindling $121,000 in Bitcoin through nearly 300 transactions. (CNBC)
12. In 2023, X (formerly Twitter) was targeted by a criminal hacker that leaked more than 220 million users email addresses. (IT Governance)
13. 500 million consumers, dating back to 2014, had their information compromised in the Marriott-Starwood data breach made public in 2018. (CSO Online) 
14. The 2019 MGM data breach resulted in hackers leaking records of 142 million hotel guests. (CPO Magazine)
15. In 2018, Under Armour reported that its “My Fitness Pal” app was hacked, affecting 150 million users. (Under Armour)
16. 100,000 groups and more than 400,000 servers in at least 150 countries were infected by the Wannacry virus in 2017, at a total cost of around $4 billion. (Technology Inquirer) 
17. Uber tried to pay off hackers to delete the stolen data of 57 million users and keep the breach quiet. (Bloomberg)
18. In one of the biggest breaches of all time, three billion Yahoo accounts were hacked in 2013. (New York Times) 
19. In 2020, cybercriminals cloned the voice of a U.A.E. company director to initiate a $35 million bank transfer. (Forbes)
20. In 2023 AT&T a breach exposed approximately 9 million customers' personal details. (IT Governance)

Employees may be a company’s biggest cybersecurity risk

• Cyber Threats

People are part of the problem when it comes to information security, so they need to be part of the solution. According to Deloitte, over 70% of companies surveyed in a recent study rated lack of employee security awareness as a vulnerability.

The Importance of Cybersecurity Training

• Employee Vulnerabilities

People are part of the problem when it comes to information security, so they need to be part of the solution. According to Deloitte, over 70% of companies surveyed in a recent study rated lack of employee security awareness as a vulnerability.

1. A 2021 LinkedIn data breach exposed the personal information of 700 million users or about 93% of all LinkedIn members. (RestorePrivacy)
2. An attack on Microsoft in March 2021 affected more than 30,000 organizations in the U.S., including businesses and government agencies. (Microsoft)
3. In April 2021, a two-year-old vulnerability was discovered that exposed the personal information of more than 533 million users. (Auth0)
4. Using a single password, hackers infiltrated the Colonial Pipeline Company in 2021 with a ransomware attack that caused fuel shortages across the U.S. (Bloomberg)
5. Meat processing company JBS was the victim of a ransomware attack that shut down beef and poultry processing plants on four different continents. (Wall Street Journal)
6. Nearly 48 million people had their personal information stolen in a 2021 T-Mobile data breach. (T-Mobile)
7. In September 2021, Neiman Marcus found an 18-month-old data breach that exposed payment data and other information for 4.6 million shoppers. (Neiman Marcus)
8. Personal data belonging to more than 100 million Android users was exposed in a 2021 data leak due to misconfigured cloud services. (Check Point)
9. In November 2021, Panasonic announced that business partner data, job candidate information, and information about interns were accessed in a breach. (Tech Crunch)
10. Trading app Robinhood was victim to a social engineering attack that compromised the personal data of 5 million users. (Robinhood)
11. A 2020 Twitter breach targeted 130 accounts including those of past U.S. presidents and Tesla CEO Elon Musk, resulting in attackers swindling $121,000 in Bitcoin through nearly 300 transactions. (CNBC)
12. In 2020, Marriott disclosed a security breach that impacted the data of more than 5.2 million hotel guests. (Marriott)
13. 500 million consumers, dating back to 2014, had their information compromised in the Marriott-Starwood data breach made public in 2018. (CSO Online) 
14. The 2019 MGM data breach resulted in hackers leaking records of 142 million hotel guests. (CPO Magazine)
15. In 2018, Under Armour reported that its “My Fitness Pal” app was hacked, affecting 150 million users. (Under Armour)
16. In 2017, 147.9 million consumers were affected by the Equifax Breach. (Equifax)
17. The Equifax breach cost the company more than $4 billion in total. (Time Magazine)
18. In 2017, 412 million user accounts were stolen from Friendfinder’s sites. (Wall Street Journal)  
19. 100,000 groups and more than 400,000 servers in at least 150 countries were infected by the Wannacry virus in 2017, at a total cost of around $4 billion. (Technology Inquirer) 
20. In 2016, Uber reported that hackers stole the information of over 57 million riders and drivers. (Uber)
21. Uber tried to pay off hackers to delete the stolen data of 57 million users and keep the breach quiet. (Bloomberg)
22. In one of the biggest breaches of all time, three billion Yahoo accounts were hacked in 2013. (New York Times) 
23. In 2020, cybercriminals cloned the voice of a U.A.E. company director to initiate a $35 million bank transfer. (Forbes)

Consumer Awareness

• Social Engineering

There are a number of ways cybercriminals can infiltrate an enterprise, but new research suggests that the biggest weakness to most companies may be the employees themselves. Malicious actors are increasingly utilizing a technique known as social engineering. In an interview with SecurityWeek, vice president and principal analyst for Forrester Research noted that educating workers about the risks associated with online communication can reduce the likelihood of experiencing a breach.

1. The average ransomware payment skyrocketed 518% in 2021 to $570,000. (GRC World Forums)
2. Malware increased by 358% in 2020. (Help Net Security)
3. Ransomware attacks rose by 435% in 2020 compared to 2019. (Help Net Security)
4. More than 300,000 Android users have downloaded banking trojan apps via the Google Play Store. (Threat Fabric)
5. In 2018, an average of 10,573 malicious mobile apps were blocked per day. (Symantec)
6. Around 26% of all web traffic is bad bot traffic. (Imperva)
7. Microsoft Office documents are the most manipulated target, with attacks rising by 112%. (Help Net Security)
8.  94% of malware is delivered by email. (Verizon)
9. The average cost of a ransomware recovery is nearly $2 million. (Sophos)
10. Only eight% of businesses that pay ransom to hackers receive all of their data in return. (Sophos)
11. 48% of malicious email attachments are Microsoft Office files. (Symantec)
12. About 60% of malicious domains are associated with spam campaigns. (Cisco) 
13. On average, a company falls victim to a ransomware attack every 11 seconds. (Cybersecurity Ventures)
14. About 20% of malicious domains are new and used around one week after they are registered. (Cisco)

Employees: Your best defense, or your greatest vulnerability

• Employee Training

It's one of the many unpleasant realities of the constant battle to protect the enterprise. The more you invest in the physical and technology perimeters, the more vulnerable the human perimeter becomes. The more effective you are at keeping intruders out of your networks, the more likely they are to focus on your employees instead. And... by the end of this decade, untrained employees will continue to be the sleeping sentries that turn corporate security into Swiss cheese. If you don't back up your investment in security technology with an equal (and relentless) commitment to training, your employees will do more harm to your reputation than a horde of hackers. As famed hacker Kevin Mitnik observed recently, "You can have the best technology, firewalls, intrusion-detection systems, biometric devices. All it takes is a call to an unsuspecting employee, and that's all she wrote, baby. They got everything." Turning employees into sentries requires a fresh approach to training that does not rely on endless lists of security rules, or sporadic warnings from IT. Employees must be shown how their behavior can contribute to the vulnerability of their workplace, and that for security to be effective, it must become as second nature as being polite to customers.

Cybercrime just got personal – and it's time employees were educated

• Training

The threat that employees bring to a company’s information security is a scary prospect to an IT director or CIO, whether it be deliberate or inadvertent. By and large, this threat is one of the hardest to mitigate with few solutions beyond cyber education for employees and monitoring online behaviour for signals of malicious activity.

1. 57% of organizations see weekly or daily phishing attempts. (GreatHorn)
2. After declining in 2019, phishing increased in 2020 to account for one in every 4,200 emails. (Symantec) 
3. 65% of cybercriminal groups used spear-phishing as the primary infection vector. (Symantec)
4. Phishing attacks account for more than 80% of reported security incidents. (CSO Online)
5. $17,700 is lost every minute due to a phishing attack. (CSO Online)

Software Piracy Convictions on the Rise

• Software Piracy

Most software piracy cases are brought to the courts by the BSA, a leading advocate for the global software industry. Statutory damages can be as much as $150,000 for each program copied. In addition, the government can criminally prosecute you for copyright infringement. If convicted, you can be fined up to $250,000, sentenced to jail for up to five years, or both..

67. By 2023, the total number of DDoS attacks worldwide will be 15.4 million. (Cisco)
68. Attacks on IoT devices tripled in the first half of 2019. (CSO Online)
69. Malicious PowerShell scripts blocked in 2018 on the endpoint increased 1,000%. (Symantec) 
70. The Mirai-distributed DDoS worm was the third most common IoT threat in 2018. (Symantec) 
71. 30% of data breaches involve internal actors. (Verizon) 
72. IoT devices experience an average of 5,200 attacks per month. (Symantec) 
73. 90% of remote code execution attacks are associated with cryptomining. (Purplesec)
74. 69% of organizations believe their antivirus software is useless against current cyber threats. (Ponemon Institute)
75. One in 36 mobile devices has high-risk apps installed. (Symantec) 

Vulnerability of Private Personal Information

• Identity Theft

76. 66% of companies say that compliance mandates are driving spending. (CSO Online)
77. 78% of companies expect annual increases in regulatory compliance requirements. (Thomson Reuters)
78. For large firms, the cost of compliance can approach $10,000 per employee. (Competitive Enterprise Institute)
79. In 2018, businesses spent an average of $1.3 million to meet compliance requirements and were expected to spend an additional $1.8 million. (IAAP)
80. On average, every employee has access to 11 million files. (Varonis)
81. 15% of companies found 1,000,000+ files open to every employee. (Varonis)
82. 17% of all sensitive files are accessible to all employees. (Varonis)
83. About 60% of companies have more than 500 accounts with non-expiring passwords. (Varonis)
84. More than 77% of organizations do not have an incident response plan. (Cybint)

Medical Issues Arising from Computer Usages

• Computer Injuries

Computer related injury (CRI) is a cluster of work-related symptoms in computer users such as Repetitive Strain Injury (RSI), Work Related Upper Limb Disorder (WRULD), Musculoskeletal Disorder (MSD), fatigue, migraine headaches and eye strain. These ailments have increased significantly and special precautions need to be taken.

85. Spain issued 212 GDPR fines in 2021 and has issued 3x more fines than any other country. (Lexology)
86. GDPR fines totaled $1.2 billion in 2021. (CNBC)
87. Companies reportedly spent $9 billion on preparing for the GDPR and, in 2018, legal advice and teams cost UK FTSE 350 companies about 40% of their GDPR budget, or $2.4 million. (Forbes)
88. 88% of companies spent more than $1 million preparing for the GDPR. (IT Governance)
89. In the GDPR’s first year, there were 144,000 complaints filed with various GDPR enforcement agencies and 89,000 data breaches recorded. (EDPB) 
90. 1,000 news sources blocked EU readers to avoid the GDPR compliance rules. (Nieman Lab) 
91. GDPR fines totaled $63 million in the first year. (GDPR.eu) 
92. Google was fined $57 billion for GDPR violations by CNIL, a French data protection agency. (TechCrunch)
93. Since the GDPR was enacted, 31% of consumers feel their overall experience with companies has improved. (Marketing Week) 
94. By 2019, only 59% of companies believed they were GDPR compliant. (ZDNet)
95. 70% of companies agree that the systems they put in place will not scale as new GDPR regulations emerge. (DataGrail)
96. Cybercrime’s total damages make its economic impact larger than the GDP of all but two countries: the U.S. and China. (Cybersecurity Ventures)
97. Cyber insurance prices rose 96% in Q3 2021, marking a 204% year-over-year increase. (Marsh)
98. When remote work is a factor in causing a data breach, the average cost per breach is $1.07 million higher. (IBM)
99. Artificial intelligence provides the most concrete cost mitigation in data breaches, saving organizations up to $3.81 million per breach. (IBM)
100. Organizations with a zero-trust approach saw average breach costs $1.76 million less than organizations without.
101. Security services accounted for an estimated 50% of cybersecurity budgets in 2020. (Gartner)
102. The average cost of a malware attack on a company is $2.6 million. (Accenture)
103. A data breach can cost a company an average of $1.59 million in lost business. (IBM)
104. The healthcare industry incurs the highest average data breach costs at $7.13 million. (IBM)
105. The total cost of cybercrime for each company increased by 12% from $11.7 million in 2017 to $13.0 million in 2018. (Accenture)
106. The average annual security spending per employee increased from $2,337 in 2019 to $2,691 in 2020. (Deloitte)
107. The most expensive component of a cyberattack is information loss, averaging $5.9 million. (Accenture)
108. The average cost per lost or stolen record for an individual is $146. (IBM)
109. The average total cost of a data breach in smaller companies (500 employees or less) decreased from $2.74 million in 2019 to $2.35 million in 2020. (IBM)
110. The average total cost of a breach in very large companies (more than 25,000 employees) decreased from $5.11 million in 2019 to $4.25 million in 2020. (IBM)
111. Half of large enterprises (with over 10,000 employees) are spending $1 million or more annually on security, with 43% spending $250,000 to $999,999 and just 7% spending under $250,000. (Cisco)
112. From 2019 to 2020, Scandinavia saw the largest increase in total cost of data breaches at 12%, while South Africa saw the largest decrease at 7.4%. (IBM)
113. The United States has the highest data breach costs in the world, at $8.64 million on average, followed by the Middle East at $6.52 million. (IBM)
114. In 2019, spending in the cybersecurity industry reached around $40.8 billion USD. (Statista)
115. Worldwide cybercrime costs will hit $10.5 trillion annually by 2025. (Cybersecurity Ventures)
116. More than 70% of security executives believe that their fiscal budgets will decrease in the aftermath of COVID-19. (Mckinsey) 
117. There are 1,053,468 employees working in cybersecurity in the U.S. as of February 2022. (Cyber Seek)
118. Also as of February 2022, there are nearly 600,000 job openings in the cybersecurity industry, meaning only 68% of open jobs are filled. (Cyber Seek)
119. Washington, D.C. has the highest concentration of cybersecurity professionals at more than 8x the national average. (Cyber Seek)
120. More open roles exist for systems security analysts than any other cybersecurity profession. (Cyber Seek)
121. 59% of cybersecurity professionals feel the demands of their job limit them from keeping up with cybersecurity skills. (ISSA & ESG)
122. More than half of cybersecurity professionals believe that a minimum of three years in the industry is required for proficiency. (ISSA & ESG)
123. More than two-thirds of cybersecurity professionals struggle to define their career paths. (ISSA & ESG)
124. 76% of cybersecurity professionals consider recruiting and hiring new employees difficult. (ISSA & ESG)
125. 70% of cybersecurity professionals claim their organization is impacted by the cybersecurity skills shortage. (ISSA & ESG)
126. Six in 10 security operations center professionals think only half their cybersecurity applicants are qualified. (Cyberbit) 
127. Since 2016, the demand for data protection officers has skyrocketed more than 700% because of the GDPR. (Reuters)
128. There was a 350% growth in open cybersecurity positions from 2013 to 2021. (Cybercrime Magazine)
129. 40% of IT leaders say cybersecurity jobs are the most difficult to fill. (CSO Online)
130. Cybersecurity engineers are some of the highest-paid positions in the industry, starting at $140K annually on average. (Cybint)
131. The cybersecurity unemployment rate is near 0% and is projected to remain there for the foreseeable future. (Cybersecurity Ventures)
132. By 2025, there will be 3.5 million unfilled cybersecurity jobs globally — approximately the same as in 2021. (Cybersecurity Ventures)
133. Information security analyst job positions in the U.S. are expected to grow 31% between 2019 and 2029. (Bureau of Labor Statistics)
134. Computer network architect job positions in the U.S. are expected to grow 5% between 2019 and 2029. (Bureau of Labor Statistics)
135. Computer programmer job positions in the U.S. are expected to decline 9% between 2019 and 2029. (Bureau of Labor Statistics)
136. The WannaCry ransomware attack cost the U.K.’s National Health Service (NHS) more than $100 million. (Datto)
137. The healthcare industry lost an estimated $21 billion to ransomware attacks in 2020. (Comparitech)
138. More than 93% of healthcare organizations experienced a data breach from 2017 to 2020. (Herjavec Group)
139. There were 712 healthcare data breaches in 2021, exceeding 2020 by 11%. (HIPAA Journal)
140. The total value of cryptocurrency ransoms increased almost 80,000% from 2013 to 2020. (World Economic Forum)
141. Financial services have 449,855 exposed sensitive files, 36,004 of which are open to everyone in the organization. This is the highest when comparing industries. (Varonis)
142. On average, 70% of sensitive files in the financial services industry are stale. (Varonis)
143. On average, a financial services employee has access to nearly 11 million files the day they walk in the door. For large organizations, employees have access to 20 million files. (Varonis)
144. Financial services businesses take an average of 233 days to detect and contain a data breach. (Varonis)
145. The average cost of a financial services data breach is $5.85 million. (IBM)
146. Financial breaches account for 10% of all attacks. (Verizon)
147. The financial services industry incurred the most cybercrime costs in 2018 at $18.3 million. (Accenture)
148. Trojan horse virus Ramnit largely affected the financial sector in 2017, accounting for 53% of attacks. (Cisco)
149. Manufacturing companies account for nearly a quarter of all ransomware attacks, followed by professional services with 17% of attacks and government organizations with 13% of attacks. (Security Intelligence)
150. 58% of nation-state cyberattacks originate from Russia. (Microsoft)
151. 79% of nation-state attackers target government agencies, non-government organizations (NGOs), and think tanks. (Microsoft)
152. Smaller organizations (one to 250 employees) have the highest targeted malicious email rate at one in 323. (Symantec)
153. Lifestyle (15%) and entertainment (7%) are the most frequently-seen categories of malicious apps. (Symantec) 
154. Supply chain attacks were up more than 100% year-over-year in 2021. (Symantec)
155. Remote work and lockdowns are driving a 50% increase in worldwide internet traffic, leading to new cybercrime opportunities. (World Bank)
156. There were nearly 800,000 complaints of cybercrime in 2020, up 300,000 from 2019. (FBI)
157. 27% of COVID-19 cyberattacks target banks or healthcare organizations and COVID-19 is credited for a 238% rise in cyberattacks on banks in 2020. (Carbon Black)
158. Confirmed data breaches in the healthcare industry increased by 58% during the pandemic. (Verizon)
159. 33,000 unemployment applicants were exposed to a data security breach from the Pandemic Unemployment Assistance program in May. (NBC)
160. Americans lost more than $97.39 million to COVID-19 and stimulus check scams. (Atlas VPN)
161. In the first month of the pandemic, Google blocked 18 million daily malware and phishing emails related to the coronavirus. (Google)
162. 52% of legal and compliance leaders are concerned about third-party cyber risks due to remote work since COVID-19. (Gartner)
163. 47% of employees cited distraction as the reason for falling for a phishing scam while working from home. (Tessian)
164. 81% of cybersecurity professionals report that their job function changed during the pandemic. (ISC)
165. Half a million Zoom user accounts were compromised and sold on a dark web forum during the first month of the pandemic. (CPO Magazine)
166. Remote workers have caused a security breach in 20% of organizations during the pandemic. (Malwarebytes)

List compiled by Rob Sorbers who is a software engineer specializing in web security and is the co-author of the book Learn Ruby the Hard Way. Inside Out Security.