Easy Marks: When It Comes to Data Breaches, Social Engineering Still Works

pcmag.com:

The next data breach to expose your info probably won’t involve an elite hacker sharpening some code to drill into a company’s system. Instead, the attacker may just ask the right people nicely in an ordinary-looking email. 

Social engineering, the hacking art of persuading victims to do your work for you, is not a new thing. But as Verizon’s 2023 Data Breach Investigations Report attests, the tactic still works.

This annual project of Verizon’s Threat Research Advisory Center(Opens in a new window)—based on an analysis of 16,312 security incidents categorized by VTRAC and partner organizations between Nov. 1, 2021, and Oct. 31, 2022, of which 5,199 rated as data breaches—found that a full 74% of those breaches involved human action.

That category can include such human failings as user errors (with the top mistake there “sending something to the wrong recipient”) and employees abusing privileges (usually maliciously). But the report leads off by noting that persuasively crafted emails to the right executives can be especially effective in getting recipients to hand over login credentials or even directly send money. 

The term of art for that kind of pretexting attack is business email compromise—often abbreviated as “BEC,” although we would prefer to see that shorthand reserved for “bacon egg and cheese.”(Opens in a new window) Verizon’s researchers found that it represented more than half of the social-engineering incidents. 

The good news in this 89-page, often cheekily written report—also available as an 18-page executive summary and in infographic form—is that another common corporate plague, ransomware, may have peaked. The new report has ransomware figuring in 24% of breaches, just about the same in the previous