Cybersecurity Statistics

1. IBM's X-Force found that ransomware attacks were the most common cyberattack in 2021. They accounted for 21% of attacks, down two percent from 2020.
2. IBM also reported that REvil (first used in 2018) and Ryuk (first appeared in 2019) are the most common and longest-running ransomware attack types. They account for 37% and 13% of ransomware attacks, respectively. 
3. Virustotal’s 2021 Ransomware Activity Report states that over 130 ransomware strains have been detected between 2020-2021.
4. Beyond Trust predicts ransomware attacks will become more personalized in 2022. Organizations should also expect the attacks to involve company insiders and different types of assets, including IoT devices.
5. Cybersecurity Ventures reports exponential growth in ransomware damage costs. It estimated the global damage to be $20 billion in 2021, over 57 times the 2015 costs. This number is expected to rise to $265 billion by 2031.

1. According to Ironscales’ State of Cybersecurity Survey, phishing emails have become more frequent. Since the start of the pandemic in 2020, 81% of global organizations have reported more email phishing attacks.
2. From 2020-2021, phishing attacks more than tripled. They reached a record-high of over 316,000 in December 2021, according to APWG’s 2021 Phishing Trends Report.
3. Data from the UK's Cyber Security Breaches Survey shows that phishing is the most common cyberattack on UK organizations.

1. A Google Project Zero researcher reports 18 zero-day vulnerabilities during the first half of 2022. Fifty percent of these are simply new versions of formerly patched vulnerabilities.
2. Mandiant Threat Intelligence reported a significant increase in yearly zero-days exploited. The 2021 total reached 80 zero-days, 2.5 times the number of zero-days exploited in 2019.

1. Cisco data estimates that distributed denial-of-service (DDoS) attacks will grow to 15.4 million by 2023, more than double the 7.9 million in 2018.
   
2. DDoS attacks became more prevalent in 2020, with the NETSCOUT Threat Intelligence report seeing 4.83 million attacks in the first half of the year. That equates to 26,000 attacks per day and 18 per minute.
3. More than four-fifths of data breaches in 2020 (86%) were financially motivated, according to Verizon’s 2020 Data Breach Investigations Report (DBIR).
4. Security threats against industrial control systems (ICS) and operational technology (OT) more than tripled in 2020, according to Dragos Inc.’s Year in Review report.
5. McKinsey insight finds 70% of security executives believe their budget will decrease in 2021, which will limit and reduce their spending on compliance, governance, and risk tools.
6. Organizations must defend their networks, systems, and users against several major cybersecurity threats. For example, Verizon’s 2020 DBIR found that 70% of breaches were caused by outsiders, 45% involved hacking, 86% were financially motivated, 17% involved some form of malware, and 22% featured phishing or social engineering.

Major hacking events have seen organizations suffer costly losses of data, customer details, financial records, and personal information.

1. An attack against internet giant Yahoo! in 2013 resulted in the loss of data from more than 3 billion accounts.
2. The data breach of hotel firm Marriott-Starwood resulted in the loss or compromise of information belonging to more than 500 million consumers.
3. A major data breach saw the details of 412 million FriendFinder users stolen in 2016, while a hack of Under Armor’s MyFitnessPal app in 2018 affected 150 million users.
4. Approximately 143 million consumers were affected by an attack on Equifax in 2017, which ended up costing the business more than $4 billion. The organization was found liable for the breach and fined $425 million by the Federal Trade Commission.
5. One of the most damaging attacks in history was the WannaCry ransomware attack, which first appeared in 2017. The virus infected more than 230,000 machines in 150 countries, causing damage of at least $4 billion. 
6. State-sponsored cyberattacks pose a major threat to organizations. Symantec data found that 19 people from China, 18 from Russia, 11 Iranians, and a North Korean had been indicted by the United States for state-sponsored activities and espionage.