Topsy-Turvy Data Breach Reality: Incidents Up, Victims Down

Data breaches rage on, with U.S. organizations continuing to lose people’s personal data and issue alerts to affected individuals, oftentimes without providing any details about what actually happened.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

For the first half of this year, the Identity Theft Resource Center counted 1,732 total data breach incidents, affecting 165,745,452 individuals. The vast majority of those incidents – 1,348 in all – traced to hack attacks, and collectively accounted for 69% of all victim notifications.

“This continues a long-standing trend of malicious actors being the primary cause of data compromises,” the ITRC said in a Thursday report.

The sectors accounting for the most incident reports: financial services, accounting for 22%, followed by healthcare at 16%, professional services at 13%, manufacturing at 9% and education at 6%.

Comparing the first half of this year to the first half of 2024, the number of breaches has increased by 10%. If that trend holds, 2025 will set a record for the number of known-breached organizations.

For the first half of this year, organizations collectively issued 165.7 million data notices to victims, dominated by:

Six months in, the count of data breach victims so far this year stands at only 12% of all of 2024, marking a sharp decline. The ITRC said that this suggests that “while breaches remain frequent, the scale of mega-breaches affecting hundreds of millions seen in the previous year has not been repeated in the first half of this year” (see: Mega-Breaches Bump Up 2024 Victim Count).

Supply-Chain Attacks Continue

As with last year, supply chain attacks continue to pose a significant risk. In the first half of this year, researchers counted 79 successful attacks, affecting 690 organizations in total and leading to data on 78 million people being compromised, or 47% of all known victims from January through June.

“This highlights the cascading effect that a single vulnerability in a third-party vendor can have on a multitude of organizations and their customers,” the ITRC said.

Some industries appear to be at greater supply-chain attack risk than others. Threat intelligence firm Cyble last month reported that in the first five months of this year, about two-thirds of the 79 software supply chain attacks it likewise documented directly targeted IT, technology or telecommunications firms. They are “rich potential targets for threat actors hoping to exploit downstream users,” the firm said (see: Supply Chain Attacks Really Are Surging).

One trend that continues unchecked in recent years is the propensity for breached organizations to not detail what happened, or how attackers gained initial access.

The ITRC report says for the first half of the year, 1,191 breached organizations didn’t detail any attack vector. “This lack of transparency hinders a full understanding of the threat landscape and makes it difficult for individuals and other organizations to take appropriate protective measures,” the ITRC said.

Some of those organizations may have lacked robust enough detection and monitoring capabilities to trace how their attack began.

The most recent Verizon Data Breach Investigations Report found that in the data breaches it analyzed, for known attack vectors, in 22% of cases initial access traced to credential theft – often facilitated by information-stealing malware – followed by vulnerability exploitation for 20% of incidents and phishing attacks for 16%.