The Weekly Breach Breakdown: Q3 Data Breach Analysis – A Breakdown of the Findings

• According to the Identity Theft Resource Center’s (ITRC’s) recently released Q3 Data Breach Analysis, data compromises increased by 15 percent over Q2. However, 2022 continues to track behind the record pace of 2021.
• The number of victims increased 210 percent over Q2. Supply chain attacks increased by 250 percent compared to the first six months of 2022.
• From Q4 2021 through Q3 2022, the number of data breach notices with no specific attack vector grew to 617, 37 percent of all cyberattack-related data breaches reported in the period. As a result, businesses and individuals are at increased risk of a cybercrime.
• Without the information about what is causing data breaches, organizations and individuals don’t know what steps to take to prevent becoming a victim of a similar attack.
• To learn about data compromises, consumers and businesses should visit the ITRC’s improved data breach tracking tool, notified.
• If you believe you are the victim of an identity crime, contact the ITRC. Call toll-free at 888.400.5530 or live-chat on the company website idtheftcenter.org.

Q3 Data Breach Analysis

Welcome to the Identity Theft Resource Center’s (ITRC) Weekly Breach Breakdown for October 14, 2022. Each week, we look at the most recent events and trends related to data security and privacy. This week, as part of Cybersecurity Awareness Month, we look at the data compromises that were publicly reported in the three months that ended on September 30, otherwise known as the third quarter (Q3).

Key Takeaways in the Q3 Data Breach Analysis

• Data compromises in Q3 2022 increased by 15 percent over Q2 but continued to track behind the record pace of 2021.
• The number of victims jumped dramatically in Q3 – a staggering 210 percent over Q2 2022.
• Supply Chain Attacks made a comeback in Q3 as the number of impacted entities increased 250 percent compared to the first six months of the year.
• Cyberattacks made up 88 percent of data breaches in Q3, as Phishing Attacks remained the primary attack vector for the 15th consecutive Quarter.
• More than 45 percent of data breach notices related to cyberattacks did not contain information about the attack that could assist other businesses or individuals to take actions to prevent or recover from a similar attack.

What Does it Mean?

First, with three months left in 2022, the year-to-date (YTD) number of publicly reported data compromises – 1,291 – is only 69 percent of the year-end total in 2021. Absent a dramatic increase in data compromises in Q4 2022, it is unlikely the total number of data breaches will set a record this year.

Despite a triple-digit increase in data compromise victims during Q3, according to the Q3 Data Breach Analysis, the number of victims is likely to show a year-over-year (YoY) decline for the fourth year in a row. However, the number of victims impacted by a compromise can increase significantly with only a handful of breaches. For example, two Q3 breaches – an AT&T-related breach (23M victims) and one at Neopets (69M victims) – account for more than half of the YTD victim count.

While compromises due to Physical Attacks and System or Human Errors still exist, cyberattacks have been and will continue to be the most common cause of data breaches. Phishing is, by far, the most common attack vector. However, ransomware rebounded slightly because non-Russian affiliated groups have emerged, and cryptocurrency markets were less volatile in the Quarter.

Here’s an interesting note from the Q3 Data Breach Analysis: Malware attacks – what we traditionally think of as cyberattacks – are increasingly rare as the number of malware attacks has dropped steadily from 39 attacks in Q2 2021 to 13 in this past Quarter. That compares to 15 data breaches caused by personal information being exposed in correspondence in Q3.

From Q1 2019 through Q3 2021, the ITRC logged fewer than 20 data breach notices where there was no information about the cause of a cyberattack. From Q4 2021 through Q3 2022, the number of notices with no specific attack vector grew to 617, 37 percent of all cyberattack-related data breaches reported in the period. As a result, businesses and individuals are at increased risk of a cybercrime.

Our ability to categorize and analyze data compromise trends wholly depends on the information included in public data breach notices. If the root cause is not reported, it’s impossible to trend the data. In other words, without the information about what is causing data breaches, organizations and individuals don’t know what steps to take to prevent becoming a victim of a similar attack. You’ll hear us talk a lot more about this topic in 2023.

Contact the ITRC

If you want to learn how to protect your personal information or think you have been the victim of an identity crime, visit our website www.idtheftcenter.org. You can also speak with an expert advisor on the phone (888.400.5530), chat live on the web, or exchange emails during our normal business hours (Monday-Friday, 6 a.m.-5 p.m. PST). 

Last month, we released the Consumer Impact Report that examined how identity crimes affected individuals. You can listen to last month’s episode of our sister podcast, the Fraudian Slip, to learn more. In two weeks, we will release the companion Business Impact Report to look at what happens when small businesses are victims of cyberattacks and data breaches. However, next week, we will be back with another episode of the Weekly Breach Breakdown.