Stolen credentials through phishing attacks were the most common cause of cyber breaches among UK businesses last year, a new study has revealed.

Cybersecurity firm IDEE commissioned a survey of more than 500 IT and cybersecurity professionals within UK businesses. It found that 61 percent of businesses experienced a cyber breach in 2023, with 25 percent suffering three or more.
When asked to name the cause or causes of their most recent breach, 35 percent said it was the result of stolen credentials (passwords, tokens, etc.) through phishing attacks, making it the most common reason. The next most frequently selected factor with 29 percent was ‘a vulnerability that was not patched by their cyber security solution’.
The data also raises questions about the efficacy of password-based Multi-Factor Authentication (MFA) solutions, with 23 percent indicating that their MFA solution was bypassed or compromised in their latest breach. The same number (23 percent) suffered a breach due to a backdoor attack (malware that sidesteps authentication procedures to gain access).
“The data perfectly encapsulates the fundamental flaw behind so many MFA solutions: they are password reliant,” said Al Lakhani, CEO of IDEE.
If you liked this content…
“The cyber industry’s ‘best’ solutions in recent years have tried to bolster security with additional authentication factors like OTPs, push notifications, or QR codes, but these methods remain tethered to centrally stored passwords and are therefore susceptible to phishing attacks. Consequently, businesses continue to suffer breaches and account takeovers because they focus on detection rather than actually preventing the breach in the first place.
“Businesses’ dependence on password-reliant MFA is a case of herd mentality. It’s time to stop following others and embrace solutions rooted in transitive trust and robust identity proofing. Hopefully this research acts as a wake-up call for cyber teams across the country.”
Register now for Think Digital Identity and Cybersecurity for Government on May 8th, 2024.