By Aijaz Alam
What causes most data breaches?
A person's action or mistake, such as clicking a phishing link or sending data to the wrong recipient, played a part in 62% of the 22,625 confirmed data breaches in Verizon's 2026 Data Breach Investigations Report (November 2024 to October 2025). The most common way in was an exploited software vulnerability (31%), and 48% of breaches involved a third party.
- 62%Breaches involving a person's action or mistakeVerizon DBIR 2026, up from 60%
- 31%Breaches that started with an exploited vulnerabilityVerizon DBIR 2026, of breaches with a known way in; up from 20%
- 48%Breaches involving a third partyVerizon DBIR 2026, up from 30%
- 16%Breaches that started with phishingVerizon DBIR 2026, same as a year earlier
- 23%Breaches with human error as the root causeIBM / Ponemon, 2026 report; 55% were malicious attacks
The numbers
The full breakdown
What shows up in data breaches
| Factor | 2026 DBIR | 2025 DBIR |
|---|---|---|
| Human element: a person's action or mistake played a part | 62% | 60% |
| A third party (supplier, vendor or software provider) was involved | 48% | 30% |
| Ransomware was involved | 48% | 44% |
| External threat actors (share of actors) | 88% | Slightly lower |
| Internal actors (employees and other insiders) appeared | 12% | 18% |
Share of confirmed breaches in each report. One breach can have several factors, so the shares add to more than 100%. The 2026 DBIR covers 1 November 2024 to 31 October 2025.
How attackers first got in (initial access vector)
| Way in | 2026 DBIR | 2025 DBIR |
|---|---|---|
| Exploitation of a software vulnerability | 31% | 20% |
| Phishing | 16% | About 15% |
| Credential abuse (stolen or guessed passwords) | 13% | 22% |
| Pretexting (a made-up story, often by phone, to trick staff) | 6% | Not tracked |
Shares of non-Error, non-Misuse breaches with a known way in (n=19,905 in the 2026 DBIR). Verizon added pretexting as a vector in 2026; without it, credential abuse would have been 16%. Counting credential abuse at any step, not only the first, it was in 39% of breaches. Each column is that report's own figure: the 2025 DBIR put phishing at around 15%, while the 2026 DBIR says it remained at 16% like the previous year.
Breach patterns in the 2026 DBIR
| Pattern | Share of breaches | What it covers |
|---|---|---|
| System Intrusion | 60% | Complex attacks that combine hacking and malware, mostly ransomware |
| Social Engineering | 16% | Phishing, pretexting and other tricks aimed at people |
| Basic Web Application Attacks | About 10% | Stolen passwords and unpatched flaws used against web applications |
| Miscellaneous Errors | Nearly 9% | Mistakes such as misdelivery, misconfiguration and lost devices |
| Privilege Misuse | Just under 4% | Insiders abusing the access they have |
Each breach is put in one pattern. The Basic Web Application Attacks share is our calculation from Verizon's count (2,281 of 22,625 breaches); the others are as Verizon states them.
Human element, third parties and the top way in, by industry
| Industry | Human element | Third party involved | Exploited vulnerability as the way in |
|---|---|---|---|
| Education | 68% | 40% | 34% |
| Finance and insurance | 65% | 34% | 22% |
| Healthcare | 54% | 32% | 20% |
| Manufacturing | 56% | 61% | 38% |
| Public administration | 69% | 36% | 40% |
| Retail | 58% | 68% | 42% |
| Small and mid-size organizations (under 1,000 employees) | 45% | 55% | 26% |
From the 2026 DBIR industry and SMB summaries. Exploited vulnerabilities were the top way in for every group shown. Shares of each group's breaches; the vector column uses breaches with a known way in.
Over time
What each Data Breach Investigations Report found
| Report | Breaches analyzed | Human element | Third party involved | Exploited vulnerability as the way in |
|---|---|---|---|---|
| 2024 DBIR | 10,626 | 68% | 15% | Not stated (up 180%) |
| 2025 DBIR | 12,195 | 60% | 30% | 20% |
| 2026 DBIR | 22,625 | 62% | 48% | 31% |
Shares of each report's confirmed breaches. Definitions changed: the 2025 DBIR recalculated the human element, which put the 2024 figure at 61% on the new basis, and Verizon's contributors change every year. The 2025 DBIR put phishing as the way in at around 15%; the 2026 DBIR says it stayed at 16%.
Why sources differ
Same question, different answers
| Number | When | Who measured | Why it differs |
|---|---|---|---|
| 62% | Nov 2024 to Oct 2025 | Verizon DBIR 2026 | Share of 22,625 confirmed breaches where a person's action or mistake played a part |
| Nearly 9% | Nov 2024 to Oct 2025 | Verizon DBIR 2026 | Breaches in the Miscellaneous Errors pattern: mistakes alone, such as misdelivery |
| 23% | Mar 2025 to Feb 2026 | IBM / Ponemon | Share of 602 breached organizations whose root cause was human error (55% malicious, 22% IT failure) |
| 88% | 2025/26 | UK Cyber Security Breaches Survey | UK businesses with a breach or attack that had phishing; counts attacks as well as breaches |
Figures for the human cause of breaches range from 9% to 88% because they count different things. Verizon's 62% human element is the share of confirmed breaches in which a person's unintended action played any part: clicking a phishing link, falling for a pretext call or making an error such as sending data to the wrong person. It does not mean people were the only cause, because the same breach can also involve an exploited vulnerability or a supplier. Breaches made of mistakes alone, Verizon's Miscellaneous Errors pattern, are nearly 9%. IBM's 23% is narrower again: it is the single root cause IBM assigns to each of the 602 breached organizations it studied, next to 55% malicious attacks and 22% IT failures. The UK survey's 88% is the share of businesses that identified a breach or attack in which phishing was one of the incidents, so it counts attacks as well as breaches. Quote the measure with its base: "62% of breaches involved a person", not "62% of breaches were caused by human error".
What it means
How to use these numbers
Most breaches do not have one cause. Verizon tags every factor it can see, so a single breach can involve a person, a supplier and ransomware at once, which is why its shares add to more than 100%.
The biggest change is how attackers get in. Exploiting a software vulnerability, often in an internet-facing device or a vendor's product, is now the most common first step at 31%, up from 20%. Only 26% of the critical vulnerabilities on the US government's known-exploited list were fully fixed in 2025, and the median fix took 43 days. Stolen passwords have not gone away: credential abuse shows up at some step in 39% of breaches.
People still matter. A person's action or mistake played a part in 62% of breaches, and 48% involved a third party, often through weak sign-in settings at a vendor.
For a small business, the basics cover most of this: patch internet-facing devices quickly, turn on multi-factor login everywhere, including at suppliers, and train staff to check unexpected requests by phone before acting on them.
Method and sources
How it was measured
Method
- Publisher
- Verizon Business: 2026 Data Breach Investigations Report (DBIR)
- Sample
- 31,861 incidents, of which 22,625 were confirmed breaches, in 145 countries, 1 November 2024 to 31 October 2025, from Verizon's own cases and partner contributors. Not a random sample.
- Definition
- Human element: a person's unintended action, such as a phishing click, a pretext call or an error, played a part. Third party: a vendor's software, hosting or connection to the victim was involved. Initial access vector: the first action in the breach, among non-Error, non-Misuse breaches with a known vector (n=19,905).
- Released
- 19 May 2026
- Checked at source
- 31 October 2026, in the 2024, 2025 and 2026 DBIR PDFs on verizon.com
- Next release
- The 2027 DBIR, expected spring 2027
- Last changed
- 30 Oct 2026
- Data files
- CSV · JSON (stable links)
Sources
- Data Breach Investigations Report (DBIR), Verizon Business Vendor data
- Cost of a Data Breach Report, IBM (research by Ponemon Institute) Vendor data
- Cyber Security Breaches Survey, UK Department for Science, Innovation and Technology (DSIT) Official data
Cite this page
APA
MLA
HTML link
FAQ
More questions people ask
What percentage of data breaches are caused by human error?
It depends on the definition. In Verizon's 2026 DBIR a person's action or mistake played a part in 62% of breaches, but breaches made of errors alone were nearly 9%. IBM's 2026 report names human error as the root cause of 23% of the breaches it studied.
What percentage of breaches start with phishing?
16% in Verizon's 2026 DBIR, the same as a year earlier, plus 6% that started with pretexting, where the attacker uses a made-up story, often by phone. Exploited vulnerabilities (31%) are now the most common first step.
How many breaches involve a third party?
48% in Verizon's 2026 DBIR, up from 30% a year earlier and about 15% in the 2024 report. Verizon counts a breach as third-party when a vendor's software, its hosting of the victim's data or its connection to the victim's systems played a part.
Are most data breaches caused by insiders?
No. In Verizon's 2026 DBIR, 88% of threat actors were external, and internal actors appeared in 12% of breaches, down from 18%. Verizon says many internal cases are mistakes or workarounds rather than deliberate theft.
Every number on this page was checked at its original source (Verizon Business, IBM (research by Ponemon Institute), UK Department for Science, Innovation and Technology (DSIT)). Free to cite with a link to this page.