50+ Cybersecurity Statistics for 2023 You Need to Know – Where, Who & What is Targeted

Cybersecurity has become indispensable to our digital lives in our interconnected world. As technology advances and organizations increasingly rely on digital systems, protecting sensitive data, preserving customer trust, and ensuring uninterrupted operations have become critical objectives.

From the rising number of data breaches to the financial losses incurred by businesses and the growing sophistication of hackers, our curated list of cybersecurity statistics highlights the urgency for robust cybersecurity measures. This article will delve into some eye-opening cybersecurity data, shedding light on our challenges and emphasizing the importance of safeguarding our digital assets.

Cybersecurity Key Stats

Cybersecurity Statistics by Attack Type

In the ever-evolving landscape of cybersecurity, it is crucial to stay informed about the various cyber attacks that threaten individuals and organizations. The impact of these attacks is substantial, both in terms of financial losses and reputation.?

The FBI’s Internet Crime Report for 2022 revealed that the public reported a total of 800,944 cybercrime complaints.?

Phishing attacks were the number one crime type, with 300,497 complaints reported. The total losses due to phishing attacks exceeded $10.3 billion.?

Phishing Attack Data

Phishing attacks remain the most common cyber attack, with approximately 3.4 billion daily spam emails.
They encompass various deceptive techniques to trick individuals into revealing sensitive information or engaging in malicious activities through disguised emails or websites.?

Phishing attacks are responsible for 90% of data breaches.
This is because phishers often assume the identity of a reliable and credible entity in electronic communications.?

??According to Norton’s statistics, approximately 88% of organizations encounter spear phishing attacks within a year. This data indicates that businesses are targeted almost daily.?

A Q1 2022 report published by Check Point Research revealed a list of the top brands ranked by their overall appearance in brand phishing attempts.?

1. LinkedIn (relating to 52% of all phishing attacks globally)
2. DHL (14%)
3. Google (7%)
4. Microsoft (6%)
5. FedEx (6%)
6. WhatsApp (4%)
7. Amazon (2%)
8. Maersk (1%)
9. AliExpress (0.8%)
10. Apple (0.8%)

LinkedIn was related to 52% of phishing-related attacks worldwide.?This significant figure represents the first time a social media platform has claimed the top spot in the rankings, indicating the severity of the issue. An example of a typical LinkedIn phishing email looks like this:

In Q4 2022, Yahoo experienced a notable rise of 23 positions at 20% due to an effective phishing campaign in the previous quarter.
LinkedIn dropped to number five on the list with a 5.7% overall appearance in brand phishing attempts.?

With the rise of remote work, there has been an increase in business email compromise (BEC) scams.
These scammers employ phishing email-based tactics to deceive individuals into disclosing confidential company information or making unauthorized money transfers.?

In 2022, the IC3 recorded 21,832 complaints related to BEC, resulting in adjusted losses exceeding $2.7 billion.

??Distributed Denial of Service (DDoS) Data

A distributed denial of service (DDoS) attack is a malicious attempt to disrupt the normal functioning of a network, service, or website by overwhelming it with a flood of internet traffic.
A DDoS attack aims to disrupt or incapacitate the target’s resources and infrastructure, leading to service downtime and potential financial losses.

In 2022, Microsoft mitigated an average of 1,435 DDoS attacks daily.?

• The maximum number of daily attacks was 2,215 on September 22, 2022.
• The minimum number of daily attacks was 680 on August 22, 2022.
• The total number of unique attacks mitigated in 2022 was over 520,000.?

According to a report released by Cloudflare, ransom DDoS attacks saw a year-on-year increase of 67% and a quarter-on-quarter increase of 24%.
Online industries experienced a significant rise in application-layer DDoS attacks, with a quarter-on-quarter increase of 131% and a year-on-year increase of 300%.

In September 2017, a record-breaking DDoS attack targeted Google services, reaching an enormous size of 2.54 Tbps.
Google Cloud disclosed this incident in October 2020.?

The attack has been attributed to China and was found to originate from the network of four Chinese internet service providers.
The hackers sent spoofed packets to 180,000 web servers, which sent responses to Google.

One of the most significant DDoS attacks occurred in March 2023. The website of the French National Assembly experienced a temporary outage due to a DDoS attack orchestrated by Russian hackers. In a Telegram post, the hackers attributed the attack to the French government’s support for Ukraine.

Malware Data

As of 2023, 300,000 fresh malware instances are generated daily, 92% distributed through email, with an average of 49 days to be detected.
Malware software is utilized to gain unauthorized access to IT systems, steal data, disrupt system services, or cause harm to IT networks.?

?4.1 million websites are infected with malware.
And 18% of websites are found to contain critical cybersecurity threats.

Additionally, 97% of all security breaches on websites exploit WordPress plugins.
Of the 47,337 malicious plugins installed from 2012 to 2021, 94% were active on 24,931 different WordPress websites, each hosting two or more malicious plugins.

As per SonicWall’s 2023 Cyber Threat Report, malware experienced its first increase since 2018, surging to 5.5 billion attacks, representing a 2% year-over-year increase.
Although the slight increase, the soaring cryptojacking and IoT malware rates largely drove the substantial rise.

In 2022, cryptojacking witnessed a 43% surge, while IoT malware experienced a staggering 87% increase.
The combined gains in cryptojacking and IoT malware offset the decline in global ransomware volume, leading to a positive shift in overall malware trends for the first time since 2018.

Ransomware Data?

Within the realm of malware, ransomware stands out as a specific type that holds targeted data or systems hostage until the victim makes a ransom.?

??According to SonicWall, there were 493.3 million ransomware attempts in 2022, demonstrating a notable decline of 21% observed year-over-year.
In 2020, there was a 62% increase, and an additional surge of 105% in 2021.?

However, these types of cyberattacks still accounted for 12% of critical infrastructure breaches in 2022, making them responsible for more than a quarter of breaches in critical infrastructure industries.

Despite a slight decrease of just over one-fifth, 2022 remains the second-highest year ever recorded for global ransomware attacks.

Furthermore, the figures for 2022 are much closer to the extraordinarily high levels observed in 2021 than they are to previous years.
They surpassed the volumes seen in 2017 (+155%), 2018 (+127%), 2019 (+150%), and 2020 (+54%) by significant margins.

Comparitech reported the following key cybersecurity findings in their 2022 research:

The number of attacks and ransom amounts decreased from 2021 to 2022.
However, the increase in average records impacted indicates that when attacks occur, they have a more significant impact on the number of compromised records.

Types of Ransomware Attacks in Cybersecurity Statistics?

The IC3 received 2,385 ransomware complaints in 2022, resulting in adjusted losses exceeding $34.3 million.
Ransomware attackers often use social engineering techniques to access a victim’s environment.

As per the same report, the leading causes of ransomware incidents were phishing, the exploitation of Remote Desktop Protocol (RDP), and software vulnerabilities.

The table below lists the most common types of ransomware responsible for severe cyber attacks.?

LockBit, ALPHV/Blackcoats, and Hive were the three predominant ransomware variants reported to the IC3 that targeted members of critical infrastructure sectors.

Password Cracking Attack Data

In 2019, 80% of all data breaches were attributed to compromised passwords, leading to significant financial losses for businesses and consumers.
49% of users will only change one letter or digit in one of their preferred passwords when required to make a new password.

A hacker can attempt 2.18 trillion combinations of passwords and usernames 22 seconds.
Introducing a single uppercase letter to a password dramatically transforms its potential.?

And an eight-character password crack could initially be broken within one second. But this time can increase to 22 minutes by adding one upper case letter.

In 2019, a?Google Survey reported that the habit of reusing passwords across multiple accounts is notably present.?

59% of the respondents believed their accounts are safer from online threats than the average person.
69% give themselves an A or B grade when it comes to safeguarding their accounts.

According to The SANS Software Security Institute, the most common vulnerabilities are:

• Business email compromise
• Legacy protocols?
• Password reuse

Considering this critical data, how do people feel about online security and password breaches?

The LastPass Psychology of Passwords report presents noteworthy findings concerning the emotions and behaviors of respondents regarding online security.

• 45% of survey respondents hadn’t changed passwords within the past year, even after a security breach.?
• 79% agreed that compromised passwords are concerning.
• 51% rely on their memory to keep track of passwords.?
• 65% always or mostly still use the same password or a variation.

From the 3,750 professionals surveyed across seven countries, only 8% said that a strong password should not have ties to personal information.
Most users create passwords that rely on personal information linked to potentially accessible public data, such as a birthday or home address.

The most prominent methods used in password attacks include:

In December 2016, Yahoo disclosed that over one billion accounts had been compromised in the notorious 2013 breach.
During this breach, hackers gained unauthorized access to Yahoo’s systems, compromising personally identifiable information (PII). This included user names, email addresses, phone numbers, and hashed passwords. It is considered to be one of the largest data breaches in cybersecurity history.

Internet of Things (IoT) Hack Data

The Internet of Things (IoT) refers to a network of interconnected physical devices or objects.
Unlike traditional hacking of servers and systems, IoT targets devices that are connected to the internet. For example, smart home appliances like televisions, speakers, security cameras, and medical devices face attacks.?

As the number of connected devices continues to grow, the occurrence of IoT malware has skyrocketed by 87% in 2022 compared to the previous year, reaching an all-time high of 112.3 million cases.

The chart above shows that the global IoT malware volume has experienced a notable surge, leading to several alarming incidents.

For example, in January 2022, a 19-year-old researcher David Colombo revealed that he could exploit a bug in the TeslaMate dashboard to control over 25 vehicles in 13 different countries. Colombo gained remote access to various Tesla features, such as unlocking doors, opening windows, initiating keyless driving, controlling the stereo, honking the horn, and checking the car’s location and driver presence. However, Colombo stated that remote movement of the vehicle was not feasible.

In another case, the iRobot Roomba J7 series robot vacuum captured and transmitted images of a woman wearing a lavender T-shirt while using the toilet. These images were then sent to Scale AI, a startup that hires global workers to label audio, photo, and video data for AI training purposes.

Costs of Cybersecurity Data

Value of Cybersecurity Statistics

There is a significant market opportunity for cybersecurity technology and service providers, estimating it to be worth a staggering $2 trillion.
The global cybersecurity market size chart by McKinsey & Company emphasizes the potential for providers to offer innovative solutions and services in response to evolving cyber threats. This presents promising financial prospects and highlights these providers’ crucial role in fortifying digital defenses and protecting businesses from ongoing cyber risks.

Price of Cybersecurity Data Breaches

As per IBM’s Cost of a Data Breach Report, the global average cost of a data breach experienced an increase from $4.24 million in 2021 to $4.35 million in 2022.
Phishing accounted for 16% of the top attack vectors in cybercrime, with an average breach cost of $4.91 million. Additionally, breaches caused by stolen or compromised credentials amounted to $4.50 million.?

In 2022, the average price per compromised record in a data breach globally was $164, representing a 1.9% increase compared to $161 in 2021.
This increase is even more significant compared to the average cost of $146 per record in 2020, showing a rise of 12.3%.

Ransomware attacks accounted for 11% of the breaches analyzed, indicating a growth rate of 41% compared to the previous year’s 7.8% ransomware breaches.
The average ransomware attack cost slightly decreased from $4.62 million in 2021 to $4.54 million in 2022. However, this cost remained marginally higher than the average total data breach cost of $4.35 million.

IBM’s Cost of Data Breaches study also shows that remote work-related breaches cost approximately $1 million more, on average, than breaches without remote working being present.
The average cost for remote work breaches was $4.99 million, whereas breaches not influenced by remote work averaged $4.02 million. These remote work-related breaches cost approximately $600,000 more than the global average.

Over the past five years, the FBI IC3 (Internet Crime Complaint Center) has consistently received an average of 652,000 complaints annually.
Since 2018, there have been 3.26 million complaints and $27.6 billion worth of losses.?

Cybersecurity Statistics Cost for Businesses

The cost of cybersecurity for businesses can vary significantly depending on various factors due to the vast array of services and products.
For example, the size and nature of the organization, the level of security measures implemented, and the extent of potential threats all influence the costs.

According to a survey by Deloitte Insights, organizations spend approximately 10.9% of their IT budget on cybersecurity.
Companies dedicate around 0.48% of their revenue to cybersecurity expenses. In terms of spending per employee, respondents reported an average investment of approximately $2,700 per full-time employee for cybersecurity measures.

However, as per IBM’s Cost of a Data Breach study, these investments are worthwhile.

Organizations with fully deployed security AI and automation experienced breaches that were $3.05 million cheaper compared to organizations without such deployments.
This significant – 65.2% – difference in average breach cost highlighted substantial cost savings, with fully deployed organizations averaging $3.15 million while non-deployed organizations faced an average price of $6.20 million.

In addition, companies with fully deployed security AI and automation experienced a 74-day reduction in breach identification and containment compared to those without such implementations.
Fully deployed organizations had an average breach lifecycle of 249 days, while non-deployed organizations took 323 days.?

Cybersecurity Statistics by Country

Malware Volume by Country?

As per Sonic Wall’s 2023 Cyber Threat Report, The United States secures the top spot on the list with the highest volume of malware attacks, totaling 2.68 billion.
But, a significant -9% year-over-year decrease in malware instances indicates a shift in cybercriminals’ attention toward targeting other countries.

The United Kingdom occupies the second position for the highest volume of malware attacks, reporting? 432.9 million attacks in 2022.
However, it also experienced a notable year-over-year decrease of -13%.

India comes third on the list, totalling 335.4 million, showcasing a noteworthy increase of +31% year-over-year. While attack volumes generally declined in 2022, India stood out as the country with the highest growth in attack volume among those included in the study.?

Malware Spread by Country & Region?

Sonic Wall’s malware spread percentage represents the calculation of the sensors that detected a malware attack, indicating the extent of the malware’s reach in that particular region.

Vietnam was the number one country targeted by malware at 30.15%.
However, the most significant observation is the rise of Europe as a cybercrime hotspot, with the number of European countries on the list doubling since 2021, constituting the majority within the top 10.

As per the same report, Europe, LATAM, and Asia experienced significant double-digit increases in 2022, with 10%, 17%, and 38% growth rates, respectively.

Interestingly, the volume of malware in North America experienced a significant 10% year-over-year decrease, resulting in a total of 2.75 billion instances.
This figure represents the lowest recorded volume since 2017, highlighting a notable decline in malware activity in the region.

Additionally, during December, malware attempts in North America reached a record low of 158.9 million, marking the lowest monthly volume since 2018.
These developments indicate a potential shift among cybercriminals away from targeting North America and other prominent cybercrime hubs to focus on other regions worldwide.

Cyberwarfare Data – Russia and China vs the United States?

China and Russia emerge as the dominant players in the cybersecurity landscape, accounting for nearly 35% of global attacks, combined.
With 79 confirmed attacks originating from China and 75 from Russia, these two countries have targeted national governments extensively.

America’s Cyber Defense Agency frequently updates its advisories, alerts, and malware analysis reports (MARs) on Russian malicious cyber activities.
“The Russian government engages in malicious cyber activities to enable broad-scope cyber espionage, to suppress certain social and political activity, to steal intellectual property, and to harm regional and international adversaries.”

In February 2022, the BBC reported that 74% of ransomware revenue goes to Russia-linked hackers.
Researchers identified that over $400 million worth of crypto-currency payments were directed to groups strongly believed to have affiliations with Russia.

The White House released a statement in July 2021 exposing irresponsible conduct exhibited by the People’s Republic of China (PRC) in cyberspace.
“As detailed in public charging documents unsealed in October 2018 and July and September 2020, hackers with a history of working for the PRC Ministry of State Security (MSS) have engaged in ransomware attacks, cyber-enabled extortion, crypto-jacking, and rank theft from victims around the world, all for financial gain.”?

The following year, the heads of the FBI and MI5 made a first-ever joint appearance and issued a warning about the threat posed by China:
“In our world, we call that kind of behavior a clue… it would represent one of the most horrific business disruptions the world has ever seen,” said the head of the FBI, Christopher Wray.

Cybersecurity Statistics by Industry

The IC3 registered 870 complaints in 2022, reporting ransomware attacks targeting organizations within critical infrastructure sectors.
Among the 16 critical infrastructure sectors, IC3 reporting revealed that 14 sectors had at least one member that fell victim to a ransomware attack.

Critical infrastructure organizations faced an average data breach cost of $4.82 million, exceeding the average across other industries by $1 million.
Among them, 28% encountered destructive or ransomware attacks, and 17% experienced breaches due to compromised business partners.

The healthcare industry has been the costliest for ransomware breaches for 12 consecutive years, with an average data breach cost reaching $10.10 million.
Patient data is immensely valuable for cybercriminals, especially in electronic health records (EHR). These records encompass information about individuals, including their names, social security numbers, financial details, past and present addresses, and medical histories.

Meanwhile, the manufacturing industry significantly suffered from extortion attacks in 2022, with 447 recorded victims across different platforms.
The professional and legal services sector closely followed, with 343 reported victims.

Major Industries Cybersecurity Data Breaches?

In 2022, Costa Rica declared a national emergency in response to a string of ransomware attacks targeting critical institutions.
The first series of attacks were aimed at government bodies and was claimed by the Conti gang, an influential group of hackers based in Russia.

Corti’s extortion site claimed the publication of 50% of stolen data from the Cost Rican government, including 850 gigabytes of material from the finance ministry.
The attackers demanded a ransom of $10 million to prevent the leaked information from being exposed.

The second series of attacks occurred on May 31, 2022, by the HIVE ransomware group.
The primary target was the Costa Rican Social Security Fund, the entity responsible for managing the country’s health service. In addition, the attack impacted over 10,400 computers and most servers in Costa Rica. As a result, approximately 34,677 appointments were canceled that week, accounting for 7% of all scheduled appointments.?

In May 2021, Colonial Pipeline experienced a ransomware attack that completely shut down its fuel distribution pipeline.
In a span of only two hours, the cybercriminals belonging to the group known as DarkSide managed to extract nearly 100 gigabytes of data from the network of the Alpharetta, Georgia-based company.

The Colonial Pipeline paid approximately $5 million to hackers from Russia to facilitate the restoration of the nation’s largest fuel pipeline.

Similarly, in June 2021, JBS, the world’s largest meatpacking company, fell victim to a significant ransomware attack by Russian hackers.
The breach resulted in JBS paying a ransom of $11 million to the hackers who gained unauthorized access to its computer system.

The Importance of Cybersecurity?

With the rise in cyber attacks and the increasing sophistication of malicious actors, businesses and individuals face significant risks. Cybersecurity statistics reveal alarming trends, such as the escalating costs of data breaches, the prevalence of phishing attacks, and the impact of remote work on breach expenses.

However, it also sheds light on the value of cybersecurity investments, emphasizing the cost savings and improved incident response achieved by implementing security AI, automation, and incident response teams.?

As organizations continue to navigate the evolving threat landscape, it is clear that prioritizing robust cybersecurity measures is essential for safeguarding sensitive data, preserving business continuity, and protecting against financial and reputational damages.

Sources:

• Statista?
• CISCO
• IBM and the Ponemon Institute
• FBI IC3
• ConnectWise?
• Norton
• Astra
• CheckPoint
• CSIS
• Usenix
• AAG
• CNBC
• Sonic Wall?
• Sitelock
• Cloudflare
• Google Cloud
• Microsoft
• Kaspersky
• LastPass
• Google
• Yahoo
• The SANS Software Security Institute
• One Login
• Deloitte Insights
• MIT Technology
• Medium Blog
• McKinsey & Company
• Deep Instinct?
• Palo Alto Networks
• CompariTech
• The White House
• NBC
• Security Intelligence
• Privacy Affairs
• Global News
• Bloomberg

Check out more news on cybersecurity here.