Follow Us on Google Discover
Hackers are increasingly exploiting familiar weaknesses, from stolen credentials and unpatched systems to ransomware and social engineering, as cyberattacks become more effective and harder to detect.
Verizon’s 2026 Data Breach Investigations Report (DBIR), which analysed more than 31,000 security incidents, including over 22,000 confirmed breaches across 145 countries, shows that one attack pattern accounted for 61% of confirmed breaches.
System Intrusion remained the dominant breach pattern, while social engineering and web application attacks also accounted for significant shares.
The report also highlights a less obvious threat: ordinary employee mistakes, which can expose sensitive data without a hacker ever breaking into a system.
Also Read
Here are the five leading breach patterns identified by Verizon.
5. Privilege Misuse: 3% of breaches
This is the smallest of the five major patterns, but not one to ignore. It refers to where insiders deliberately abuse legitimate access for unauthorized purposes.
A common example is when an employee wants to work from home and emails company data to a personal account.
However, according to Verizon, privilege misuse has never been a dominant driver of data breaches. This is because organizations generally face far more risk from external actors than from their own employees.
When it comes to who is behind these breaches, in most cases (54%) it is an average End user. Developers account for another 22%, with System admins and Managers each at 8%, and Executives at around 3%.
Developers and System admins carry outsized weight here relative to their smaller numbers, since both roles tend to have higher levels of privileged access, raising the potential impact when misuse does occur.
Convenience, not malice, is the leading motive, present in 60% of these breaches. Financial motives follow at 33%, with Espionage and Grudge each around 4%.
A common convenience related example is an employee emailing company data to a personal account just to keep working from home. That is not malicious in the traditional sense, but it still violates policy and results in a breach.
What typically gets compromised in these cases is Personal data (60%), followed by Other data types (35%), Secrets (27%), and Internal data (25%).
4. Miscellaneous Errors: 8% of breaches
Not every breach involves an attacker at all. Miscellaneous Errors is Verizon’s catch all pattern for breaches caused by mistakes: things employees did (or failed to do) incorrectly or inadvertently, with no malicious intent involved anywhere in the chain.
There’s no hacker, no malware, no social engineering. Just a person doing their job and getting something wrong in a way that exposes data.
Verizon breaks these mistakes down by type, and the gap between the leader and everything else is wide.
- Misdelivery – sending data to the wrong recipient, accounts for 64% of errors on its own.
- Misconfiguration follows at 14%, then Loss and Publishing errors at around 7% each, and Classification errors at 6%.
Misdelivery includes emailing a spreadsheet of customer records to the wrong address, mailing physical documents to the wrong person, or granting file access to someone who shouldn’t have it.
Misconfiguration means setting up a system, database, or cloud storage bucket incorrectly, leaving it exposed to anyone who happens to find it. This is the classic “unsecured cloud database” story that shows up in breach headlines every year.
This pattern shows almost no gap between “incidents” and confirmed “breaches.” Of 1,757 incidents, 1,750 resulted in confirmed data disclosure. Once one of these mistakes happens, it almost always results in exposed data, unlike patterns where an incident might not escalate to a breach.
And what typically gets exposed is deeply personal: Personal data was compromised in 98% of these breaches, with Internal company data (16%), Other data types (8%), and Bank data (7%) trailing well behind.
3. Basic Web Application Attacks: 10% of breaches
This pattern covers direct attacks on web applications and services. According to Verizon, it remains widespread and is typically driven by stolen credentials and unpatched vulnerabilities.
These attacks are often low in sophistication, but they’re highly effective, frequently leading to credential theft, internal data exposure, and further compromise of systems downstream.
Looking at the specific techniques involved, Use of stolen credentials leads at 56%, followed closely by Exploitation of vulnerabilities at 53%. Other actions account for 30% of breaches.
Password dumper shows up in 21% of these breaches, harvesting additional credentials for further use, and Brute force follows close behind at 19%. Backdoor or C2 functionality rounds out the top techniques at 17%.
This is a 100% External actor pattern with no insiders involved. Financial gain dominates the motive mix at 74%, but Espionage accounts for a notable 23%, with Ideology driven attacks making up the remaining 3%.
What gets stolen tracks closely with how these attacks work: Credentials themselves top the list at 52%, followed by Internal data (48%), Other data types (33%), and Secrets (15%). Basic Web Application Attacks are as much about harvesting the keys to further access as they are about the initial breach itself.
Of the 3,217 incidents recorded in this pattern, 2,281 resulted in confirmed data disclosure.
Multi factor authentication and credential hygiene remain the highest leverage controls here. Web and mail servers continue to rank among the most frequently targeted assets year after year, so prioritising access controls and timely patching on those systems is still one of the more effective places to focus effort.
2. Social Engineering: 17% of breaches
This pattern is mainly focused on attacks that use deception to accomplish a specific objective such as deploying malware, harvesting credentials, or tricking someone into transferring money.
The common thread: individuals are targeted directly, not systems.
Threat actors continue to largely lean on email based phishing to compromise organizations. But according to Verizon, these attacks are getting more complex, as attackers increasingly target mobile devices and other unconventional vectors to reach victims.
Despite that shift, email remains the dominant vector by far. Email accounts for 98% of Social Engineering breaches, followed by Social media at 25% and Web application at 24%.
External actors account for 100% of these breaches. Motives are overwhelmingly Financial (86%), with Espionage a distant second (25%). What typically gets compromised include Other data types (56%), Internal data (51%), Credentials (39%), and Secrets (31%).
The big shift is happening on mobile. Verizon found that voice calls and text messages had a 40% higher success rate than traditional email phishing.
Verizon’s researchers also separate two techniques that get lumped together but require very different defenses.
- Phishing is asynchronous: a malicious email or text sent and left to do its work.
- Pretexting involves the attacker creating a fabricated scenario in real time, often through a phone call, text or email exchange, to manipulate someone (frequently an IT help desk or customer support agent) into taking a harmful action.
Email phishing training alone is no longer enough. Organisations need stronger business process safeguards for voice and text based social engineering, particularly around help desks and customer support teams where pretexting is increasingly used as an opening move.
1. System Intrusion: 61% of breaches
System Intrusion has been the top breach pattern since 2022, and this year it widened its lead considerably, jumping from 53% of breaches last year to 61% this year.
While several breach patterns involve some degree of system intrusion, this pattern specifically covers the more complex, involved breaches, where determined external actors combine Malware and other tooling with Hacking techniques to compromise closely guarded data.
External actors account for 100% of these breaches. Main motives behind these are Financial (88%), with Espionage a distant second (12%). What gets compromised is dominated by Internal data (93%), followed by Credentials (26%), Other data types (20%), and Secrets (13%).
Of 14,309 incidents in this pattern, 13,758 resulted in confirmed data disclosure, the largest incident volume of any pattern in the report.
Looking at the specific techniques involved, Ransomware tops the list by a wide margin, appearing in 77% of breaches within this pattern. Use of stolen credentials and Exploitation of vulnerabilities follow in a near even split, at 39% and 38% respectively. Other actions account for 29% of breaches, with Password dumper and Backdoor or C2 functionality each appearing in 16%.
A few things are reshaping how these attacks unfold within this pattern specifically:
- Remote monitoring and management (RMM) tool abuse is exploding: attackers are increasingly abusing legitimate administrative software to operate inside victim networks, with these techniques growing 240% year over year, while the Backdoor or C2 action declined 27% over the same period.
Defenders appear to be getting better at detecting traditional tools, pushing attackers toward blending in with legitimate remote access software instead.
- The ransomware economics are also shifting. The median ransom payment dropped again, to $139,875 from $150,000 the year before, and 69% of victims now refuse to pay at all, up from 65% the year before.
Attackers are responding by trying to inflict maximum business disruption to pressure victims faster.
The Bottom Line
The findings show that while attackers continue to change their techniques, many breaches still depend on familiar weaknesses, including unpatched vulnerabilities, compromised credentials, social engineering, and excessive access.
Verizon’s broader message is that organisations need to strengthen these fundamentals as the speed and scale of attacks increase.
