Ransomware, espionage and data breaches? Yep – Verizon just dropped a 117-page thriller

The key takeaways from Verizon's 117-page Data Breach Investigations Report? Things are getting worse on pretty much every front. For starters, there has been a 34% spike in attacks that exploit system vulnerabilities – zero-day exploits are especially on the rise, hitting perimeter hardware and VPNs hard. Ransomware isn't slowing down either, now showing up in 44% of breaches – up 37% from last year – even though the average payout actually dropped.

One of the more concerning trends? Breaches involving third parties have doubled, jumping from 15% to 30%. This throws a spotlight on the dangers lurking in supply chains and partner networks. Human error is still a major player, too, with around 60% of breaches involving people in some way – social engineering and credential abuse are the usual suspects.

There were also a few standout cases involving credential reuse in third-party environments. One stat that really pops: when secrets were leaked on GitHub, it took a median of 94 days to fix the issue. Verizon also found that 30% of compromised systems tied to info-stealer malware were clearly company-owned, but nearly half of them weren't managed properly and contained both personal and work logins. That is a big red flag, especially in BYOD setups or when employees stretch company policies.

​​Espionage-motivated breaches are creeping up, too, now making up 17% of all cases. But here is the twist – about 28% of incidents tied to state-sponsored groups weren't about spying at all but were financially motivated.

And, of course, AI is starting to show up in the mix. While generative AI hasn't taken over the world (yet), threat actors are already using it. One of Verizon's partners noted that AI-generated content in malicious emails has doubled in the last two years.

Plus, 15% of employees are hitting up GenAI tools from their work devices at least every couple of weeks. Alarmingly, a significant portion of these employees were using non-corporate emails (72%) or corporate emails without proper authentication (17%), suggesting that many are bypassing corporate policies.

Now, if you think about it, you have probably encountered a data breach, phishing attack, or scam at least once. T-Mobile's users, for example, are already receiving their disappointing data breach settlement checks. Verizon itself has faced its own breaches in the past, including one where a subsidiary paid $16 million after three breaches exposed subscribers to attacks.

On the bright side, Verizon Business recently rolled out a new cybersecurity solution called Trusted Connection. It is built to give companies stronger protection across the board – from devices and networks to cloud apps. But still, based on these numbers, it's clear we're going to need every tool we can get.