Data Breach Investigations Report

Verizon Business released the results of its 16th annual Data Breach Investigations Report (DBIR), an analysis of 16,312 security incidents and 5,199 confirmed breaches across dozens of countries. The report draws on contributions from 87 industry partners — including law enforcement agencies, forensic firms, and managed security providers — making it one of the most data-rich assessments of the global threat landscape published each year.

The headline finding is stark: the cost and frequency of social engineering attacks have reached new highs, while the human element remains the dominant factor in the overwhelming majority of breaches.

Ransomware Costs More Than Ever

Ransomware remains one of the most financially damaging threat types tracked in the report. The median cost per ransomware incident more than doubled over a two-year period, reaching $26,000. At the upper end of the scale, 95% of incidents that resulted in a financial loss cost organizations between $1 and $2.25 million.

This rise in cost coincides with a significant increase in frequency. Over the previous couple of years, the number of ransomware attacks exceeded the total from the prior five years combined. In the period covered by this report, ransomware held steady as a major threat, accounting for almost a quarter of all breaches — approximately 24%.

Critically, the report emphasizes that no organization is immune to ransomware, regardless of size, industry, or geography. The attack pattern is well-established and continues to be executed at scale by organized criminal groups.

The Human Element: Still the Dominant Factor

Despite growing investment in security technology and increased employee training across many organizations, the human element remains a factor in 74% of all breaches. People are exploited through a combination of errors, privilege misuse, use of stolen credentials, and social engineering attacks.

Social engineering — manipulating people into revealing sensitive information or taking unsafe actions — is one of the most consistently effective tactics available to attackers. Phishing, where a user is tricked into clicking a malicious link or opening a dangerous attachment, remains a top delivery mechanism. But the report highlights a significant shift: pretexting, which involves fabricating a convincing scenario to manipulate a target, has overtaken phishing as the dominant social engineering method for the first time.

According to the report, pretexting — most commonly executed through Business Email Compromise (BEC) — more than doubled compared to the previous period and now accounts for more than 50% of social engineering incidents. The FBI’s Internet Crime Complaint Center reported that BEC scams cost businesses more than $2.7 billion in losses in a single year, underscoring just how financially devastating this attack type has become.

Senior Leadership: A Growing and Underprotected Target

One of the more striking findings called out in the report’s commentary is the growing cybersecurity risk posed by senior leadership. Chris Novak, Managing Director of Cybersecurity Consulting at Verizon Business, addressed this directly:

“Senior leadership represents a growing cybersecurity threat for many organizations. Not only do they possess an organization’s most sensitive information, they are often among the least protected, as many organizations make security protocol exceptions for them. With the growth and increasing sophistication of social engineering, organizations must enhance the protection of their senior leadership now.”

This observation reflects a broader dynamic: attackers actively target executives precisely because they have access to high-value information and are frequently exempt from the same security controls applied to the rest of the workforce.

Stolen Credentials: The Top Entry Point

Stolen or compromised credentials continue to be the leading method attackers use to gain unauthorized access to organizational systems. The report notes that credentials appear as the top action variety in nearly half of all breaches. Once obtained — through phishing, infostealer malware, or purchase on dark web markets — credentials allow attackers to bypass traditional perimeter defenses and log in as legitimate users.

The connection between credential theft and ransomware is direct: ransomware operators typically obtain access through initial access brokers who sell verified credentials. This means that credential hygiene is not just an identity management issue — it is a ransomware prevention issue.

Log4j: Speed of Exploitation Reveals the Real Risk

The report includes an analysis of the Log4j vulnerability, which generated significant alarm in the security community when it was disclosed. While the vulnerability was ultimately less prominent in confirmed breaches than initially feared, the data reveals something more instructive than the final breach count: the speed at which threat actors moved to exploit it.

32% of all yearly Log4j vulnerability scanning occurred within the first 30 days after its release. This figure illustrates just how quickly attackers escalate from proof-of-concept to mass exploitation once a new vulnerability becomes public. For defenders, the window to patch before active exploitation begins is shorter than many patching cycles allow.

Financial Gain Drives Almost All Attacks

Despite the prominence of espionage in news coverage — particularly given the geopolitical tensions of the period analyzed — the data tells a different story. Only 3% of threat actors were motivated by espionage. The remaining 97% were driven by financial gain.

This has a practical implication for how organizations should prioritize their defenses. While nation-state threats are real and relevant to specific sectors, the vast majority of organizations are far more likely to face financially motivated criminal actors using well-understood, scalable attack methods — credential theft, social engineering, and ransomware — than sophisticated state-sponsored intrusions.

Why the DBIR Matters

The report’s value lies in its grounding in real incident data rather than vendor-driven narratives or theoretical threat models. Craig Robinson, Research Vice President at IDC, described it this way:

“Verizon’s Data Breach Investigations Report provides deep insights into the topics that are critical to the cybersecurity industry and has become a source of truth for the business community.”

For security teams, executives, and board members alike, the DBIR offers a data-backed foundation for making investment decisions, prioritizing controls, and communicating risk in concrete terms.

Key Takeaways

• 16,312 security incidents and 5,199 confirmed breaches were analyzed.
• Ransomware is present in 24% of all breaches; median incident cost reached $26,000.
• 74% of breaches involve the human element.
• BEC/pretexting attacks more than doubled and now represent over 50% of social engineering incidents.
• Stolen credentials are the top action variety, present in nearly half of all breaches.
• 97% of threat actors are financially motivated; only 3% are espionage-driven.
• 32% of Log4j scanning occurred within 30 days of disclosure, highlighting the speed of exploitation.