Phishing attacks are becoming more prevalent across almost all industries worldwide. But some industries are targeted more frequently than others.
Email fraud remains one of the most common ways cybercriminals gain unauthorized access to their victims’ IT systems. Now, however, cybercriminals are beginning to expand their attacks to include more sophisticated tactics that rely on email, social media, and even victims’ mobile devices. You need more than email security to protect yourself against phishing.
We’ve compiled some of the latest statistics on industry-specific cybersecurity into a single resource for small businesses, mid-sized organizations, and enterprises. Find out where your organization stands.
Phishing Attacks by Industry
Globally, phishing attack attempts grew by 80% across all industries between 2017 and 2018. But this growth has not been uniform. According to the latest cybersecurity statistics, the top three phishing targets for 2018 were:
- Pharmaceutical Manufacturers
- Retail and eCommerce Companies
- Government Institutions
Cybersecurity professionals have collected specific data related to each of these industries. Each one presents a unique set of advantages to cybercriminals and hackers.
1. The Pharmaceutical Industry
At first, it might seem surprising that the pharmaceutical industry would be targeted by cybercriminals, but there are good reasons for this. The success of any pharmaceutical manufacturer relies on its intellectual properties – the recipes they follow for the various drugs and compounds they create.
Cybercriminals who successfully get their hands on this kind of intellectual property can sell it on the black market for enormous sums of money.
Alternately, they can hold the manufacturer ransom and extort money out of them in exchange for keeping their trade secrets secret.
In 2018, organizations in the pharmaceutical industry reported an average of 282 cyber attack attempts per company over the course of the year. This corresponds to a 149% jump in the number of email phishing attempts compared to the same period in 2017.
2. The Retail and eCommerce Sector
Retail and ecommerce organizations are among the most targeted cyber attack victims for an obvious reason – hackers see large retail brands as wealthy and easy to fool. However, smaller retail organizations are also targeted frequently, and unlike large retail enterprises, they rarely have adequate cybersecurity solutions in place for protection from phishing attacks.
Retail accounted for almost 40% of all known cyberattacks in the second half of 2014. These attacks include everything from business email compromise attacks to user data breaches. Each type of attack has a unique scope and purpose against which retailers must protect themselves.
There is another reason why cybercriminals so frequently target retail and ecommerce organizations. Consumers who entrust their personal data to these organizations are used to receiving marketing messages from them. It’s much easier to defraud an email user who is used to reading a weekly newsletter from an ecommerce site than to impersonate the victims’ co-workers, friends, or family.
3. Government Institutions
It should come as no surprise that government institutions frequently find themselves targeted by cybercriminals. Email fraud attacks targeting government employees soared during 2018 and are unlikely to slow down any time soon.
For cybercriminals interested in sensitive data, there are few better options than government institutions. Government institutions have to collect sensitive data on citizens in order to function. The size and complexity of government mean that any government institution is likely to have multiple vulnerabilities to exploit – it’s simply not feasible to close them all.
Government and military institutions face additional challenges when securing their data against cybercrime. Instead of just facing ambitious, enterprising cybercriminals, they must also reliably protect themselves from state-sponsored espionage. Today’s spies don’t have to travel across the world like James Bond – they phish government email addresses and attempt to pilfer state secrets en masse.
Which Employees Get Targeted the Most?
Once cybersecurity teams understand hackers’ motives, they begin to see patterns in the types of individual accounts most frequently compromised. In order to establish a robust security system, they must improve the defenses of organizations’ most targeted employees.
According to the latest studies, IT and financial employees are the most common targets. In most cases, cybercriminals begin their attack by exploiting a general employee in one of these departments – typically choosing someone new and veering away from management-level employees.
Executives are the next most common targets. CEOs and CFOs make easy targets because there is usually a great deal of public information about them available online. If a cybercriminal manages to gain unauthorized access to a company’s IT system by compromising an entry-level employee account, compromising an executive-suite account is a logical next step. That’s where all the valuable data and financial information is.
Spear Phishing Disclaimer
Although the statistics above use the latest data available in the cybersecurity industry, email phishing is not simple enough to easily reduce into neat categories. All of the studies mentioned equate regular mass phishing and spear phishing – mostly because the two are difficult to distinguish from the victim’s point of view.
Mass phishing schemes simply attempt to scam the largest number of people possible. An example of this would be a cybercriminal sending off an email blast that spoofs a well-known ecommerce vendor like Paypal, attempting to get as many login credentials as possible.
Spear phishing requires research and a much more direct approach. A cybercriminal who poses as a particular employee of a particular vendor to trick a particular employee into giving up financial data is spear phishing. For the purpose of statistics, both are treated as phishing attempts, but the latter is obviously much harder to identify and protect against than the former.
In the pharmaceutical, retail, and government sectors, spear phishing is far more prevalent than in other industries. This is because successfully attacking a large-scale organization offers more value than attacking a small one. Essentially, it’s worth the cybercriminals’ time.
However, small retail businesses are disproportionately targeted because they often deal with large volumes of data yet don’t have the resources to successfully protect that data. This is why small retailers suffer greater email security risks than small businesses in many other industries.
Sources:
Phishing warning: If you work in this one industry you’re more likely to be a target
Phishing: Who Is Being Targeted By Phishers?
Phishing Attacks On The Retail Industry
The Latest in Phishing: October 2018
Protecting People: A Quarterly Analysis Of Highly Targeted Cyber Attacks