{ "question": "What causes most data breaches?", "answer": "A person's action or mistake, such as clicking a phishing link or sending data to the wrong recipient, played a part in 62% of the 22,625 confirmed data breaches in Verizon's 2026 Data Breach Investigations Report (November 2024 to October 2025). The most common way in was an exploited software vulnerability (31%), and 48% of breaches involved a third party.", "period": "Nov 2024 to Oct 2025", "key_numbers": [ { "value": "62%", "label": "Breaches involving a person's action or mistake", "note": "Verizon DBIR 2026, up from 60%", "stat": "cybersecurity/breaches-with-human-element" }, { "value": "31%", "label": "Breaches that started with an exploited vulnerability", "note": "Verizon DBIR 2026, of breaches with a known way in; up from 20%", "stat": "cybersecurity/breaches-start-with-vulnerability-exploitation" }, { "value": "48%", "label": "Breaches involving a third party", "note": "Verizon DBIR 2026, up from 30%", "stat": "cybersecurity/breaches-with-third-party-involvement" }, { "value": "16%", "label": "Breaches that started with phishing", "note": "Verizon DBIR 2026, same as a year earlier" }, { "value": "23%", "label": "Breaches with human error as the root cause", "note": "IBM / Ponemon, 2026 report; 55% were malicious attacks" } ], "tables": [ { "id": "factors", "title": "What shows up in data breaches", "columns": [ "Factor", "2026 DBIR", "2025 DBIR" ], "rows": [ [ "Human element: a person's action or mistake played a part", "62%", "60%" ], [ "A third party (supplier, vendor or software provider) was involved", "48%", "30%" ], [ "Ransomware was involved", "48%", "44%" ], [ "External threat actors (share of actors)", "88%", "Slightly lower" ], [ "Internal actors (employees and other insiders) appeared", "12%", "18%" ] ], "row_ids": [ "human-element", "third-party", "ransomware-share", "actor-external", "actor-internal" ], "note": "Share of confirmed breaches in each report. One breach can have several factors, so the shares add to more than 100%. The 2026 DBIR covers 1 November 2024 to 31 October 2025.", "source": "verizon-dbir" }, { "id": "initial-access", "title": "How attackers first got in (initial access vector)", "columns": [ "Way in", "2026 DBIR", "2025 DBIR" ], "rows": [ [ "Exploitation of a software vulnerability", "31%", "20%" ], [ "Phishing", "16%", "About 15%" ], [ "Credential abuse (stolen or guessed passwords)", "13%", "22%" ], [ "Pretexting (a made-up story, often by phone, to trick staff)", "6%", "Not tracked" ] ], "row_ids": [ "exploitation", "phishing", "credential-abuse", "pretexting" ], "note": "Shares of non-Error, non-Misuse breaches with a known way in (n=19,905 in the 2026 DBIR). Verizon added pretexting as a vector in 2026; without it, credential abuse would have been 16%. Counting credential abuse at any step, not only the first, it was in 39% of breaches. Each column is that report's own figure: the 2025 DBIR put phishing at around 15%, while the 2026 DBIR says it remained at 16% like the previous year.", "source": "verizon-dbir" }, { "id": "patterns", "title": "Breach patterns in the 2026 DBIR", "columns": [ "Pattern", "Share of breaches", "What it covers" ], "rows": [ [ "System Intrusion", "60%", "Complex attacks that combine hacking and malware, mostly ransomware" ], [ "Social Engineering", "16%", "Phishing, pretexting and other tricks aimed at people" ], [ "Basic Web Application Attacks", "About 10%", "Stolen passwords and unpatched flaws used against web applications" ], [ "Miscellaneous Errors", "Nearly 9%", "Mistakes such as misdelivery, misconfiguration and lost devices" ], [ "Privilege Misuse", "Just under 4%", "Insiders abusing the access they have" ] ], "row_ids": [ "system-intrusion", "social-engineering", "basic-web", "misc-errors", "privilege-misuse" ], "note": "Each breach is put in one pattern. The Basic Web Application Attacks share is our calculation from Verizon's count (2,281 of 22,625 breaches); the others are as Verizon states them.", "source": "verizon-dbir" }, { "id": "by-industry", "title": "Human element, third parties and the top way in, by industry", "columns": [ "Industry", "Human element", "Third party involved", "Exploited vulnerability as the way in" ], "rows": [ [ "Education", "68%", "40%", "34%" ], [ "Finance and insurance", "65%", "34%", "22%" ], [ "Healthcare", "54%", "32%", "20%" ], [ "Manufacturing", "56%", "61%", "38%" ], [ "Public administration", "69%", "36%", "40%" ], [ "Retail", "58%", "68%", "42%" ], [ "Small and mid-size organizations (under 1,000 employees)", "45%", "55%", "26%" ] ], "row_ids": [ "ind-education", "ind-finance", "ind-healthcare", "ind-manufacturing", "ind-public", "ind-retail", "ind-smb" ], "note": "From the 2026 DBIR industry and SMB summaries. Exploited vulnerabilities were the top way in for every group shown. Shares of each group's breaches; the vector column uses breaches with a known way in.", "source": "verizon-dbir" }, { "id": "history", "title": "What each Data Breach Investigations Report found", "columns": [ "Report", "Breaches analyzed", "Human element", "Third party involved", "Exploited vulnerability as the way in" ], "rows": [ [ "2024 DBIR", "10,626", "68%", "15%", "Not stated (up 180%)" ], [ "2025 DBIR", "12,195", "60%", "30%", "20%" ], [ "2026 DBIR", "22,625", "62%", "48%", "31%" ] ], "row_ids": [ "dbir-2024", "dbir-2025", "dbir-2026" ], "note": "Shares of each report's confirmed breaches. Definitions changed: the 2025 DBIR recalculated the human element, which put the 2024 figure at 61% on the new basis, and Verizon's contributors change every year. The 2025 DBIR put phishing as the way in at around 15%; the 2026 DBIR says it stayed at 16%.", "source": "verizon-dbir" } ], "sources": [ { "name": "Data Breach Investigations Report (DBIR)", "publisher": "Verizon Business", "type": "vendor", "url": "https://www.verizon.com/" }, { "name": "Cost of a Data Breach Report", "publisher": "IBM (research by Ponemon Institute)", "type": "vendor", "url": "https://www.ibm.com/" }, { "name": "Cyber Security Breaches Survey", "publisher": "UK Department for Science, Innovation and Technology (DSIT)", "type": "official", "url": "https://www.gov.uk/" } ], "content_changed_on": "2026-10-30", "page_url": "https://digitaltreed.com/statistics/cybersecurity/data-breach-causes", "csv_url": "https://digitaltreed.com/statistics/cybersecurity/data-breach-causes.csv" }