Editorial

Stolen credentials the leading cause of cyber breaches in 2023

Businesses’ dependence on password-reliant MFA is a case of “herd mentality” says cybersecurity CEO.

Posted 6 March 2024 by Christine Horton


Stolen credentials through phishing attacks were the most common cause of cyber breaches among UK businesses last year, a new study has revealed.

Cybersecurity firm IDEE commissioned a survey of more than 500 IT and cybersecurity professionals within UK businesses. It found that 61 percent of businesses experienced a cyber breach in 2023, with 25 percent suffering three or more.

When asked to name the cause or causes of their most recent breach, 35 percent said it was the result of stolen credentials (passwords, tokens, etc.) through phishing attacks, making it the most common reason. The next most frequently selected factor with 29 percent was ‘a vulnerability that was not patched by their cyber security solution’.

The data also raises questions about the efficacy of password-based Multi-Factor Authentication (MFA) solutions, with 23 percent indicating that their MFA solution was bypassed or compromised in their latest breach. The same number (23 percent) suffered a breach due to a backdoor attack (malware that sidesteps authentication procedures to gain access).

“The data perfectly encapsulates the fundamental flaw behind so many MFA solutions: they are password reliant,” said Al Lakhani, CEO of IDEE.

“The cyber industry’s ‘best’ solutions in recent years have tried to bolster security with additional authentication factors like OTPs, push notifications, or QR codes, but these methods remain tethered to centrally stored passwords and are therefore susceptible to phishing attacks. Consequently, businesses continue to suffer breaches and account takeovers because they focus on detection rather than actually preventing the breach in the first place.

“Businesses’ dependence on password-reliant MFA is a case of herd mentality. It’s time to stop following others and embrace solutions rooted in transitive trust and robust identity proofing. Hopefully this research acts as a wake-up call for cyber teams across the country.”

Register now for Think Digital Identity and Cybersecurity for Government  on May 8th, 2024.

Event Logo

If you are interested in this article, why not register to attend our Think Digital Identity and Cybersecurity for Government conference, where digital leaders tackle the most pressing issues facing government today.


Register Now