Summary Points
- Cyberattacks are increasingly slipping undetected, with damage occurring within minutes, mainly through exploiting existing access points rather than system hacking.
- Identity-based attacks, especially involving passwords and legitimate account abuse, comprise 97% of incidents, with phishing, social engineering, and supply chain breaches remaining core threats.
- Business email compromise (BEC) accounts for over 70% of incidents, often lasting weeks undetected, frequently initiated through phishing.
- Ransomware, especially via RaaS and insider credential marketplaces, poses a major threat, with vulnerable sectors like industrial, construction, and logistics being primary targets.
Key Challenge
The report from Eye Security’s 2026 State of Incident Response reveals a troubling rise in undetected cyberattacks, which often cause damage within minutes. Attackers now prefer exploiting existing access points over traditional hacking, with identity-based breaches, particularly involving passwords, accounting for 97% of incidents. These breaches frequently involve abuse of legitimate accounts and are often initiated through phishing, social engineering, or exploiting vulnerable internet systems, consistent with methods from previous years. Business email compromise (BEC) dominates these attacks, representing over 70% of incidents, often remaining hidden for weeks without vigilant monitoring.
Furthermore, ransomware continues to be a significant threat, especially with new platforms like Ransomware-as-a-Service lowering barriers for attackers. Notably, insider knowledge has become commercialized, as groups such as ShinyHunters recruit employees to sell access credentials, blurring the lines between external and insider threats. Industries like manufacturing, construction, and logistics are most impacted, frequently targeted through unprotected applications, insecure remote access, and phishing emails that unintentionally disclose login credentials. The report, based on 630 analyzed incidents in Europe from 2023 to 2025, underscores the evolving landscape of cyber threats and the need for vigilant, continuous security measures.
Potential Risks
Cybercriminals targeting identities is a serious threat that can occur to any business, regardless of size or industry. When hackers gain access to personal data, the fallout can be swift and damaging. For example, stolen identities lead to financial loss, damaged reputation, and legal consequences. Moreover, these breaches often cause customer trust to plummet, which in turn reduces sales and market value. Transitioning from just a security concern to a crisis, such attacks can cripple daily operations and force costly recovery efforts. Therefore, safeguarding sensitive information is not just advisable—it’s essential for business survival in today’s digital landscape.
Possible Actions
In an era where cybercriminals increasingly target identities for malicious purposes, the importance of timely remediation cannot be overstated. Prompt action not only minimizes potential damage but also helps maintain trust and safeguards sensitive information. Acting swiftly is essential to prevent further exploitation and to ensure continued security integrity.
Identify Breach
- Conduct thorough detection of compromised accounts or data.
- Review logs and alerts for suspicious activity related to identity theft.
Containment
- Isolate affected systems or accounts to prevent spread.
- Disable compromised user access immediately.
Eradication
- Remove malicious files, unauthorized access points, or malware.
- Apply necessary patches or updates to vulnerable systems.
Recovery
- Reset passwords and re-establish secure user access.
- Monitor systems for residual threats post-remediation.
Notification and Reporting
- Notify affected individuals and relevant authorities per legal requirements.
- Document the incident and response actions for future reference.
Prevention Measures
- Implement multi-factor authentication.
- Regularly update and patch all systems.
- Educate staff about phishing and social engineering threats.
- Conduct routine security audits and vulnerability assessments.
Advance Your Cyber Knowledge
Discover cutting-edge developments in Emerging Tech and industry Insights.
Explore engineering-led approaches to digital security at IEEE Cybersecurity.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
