Today, the Identity Theft Resource Center® (ITRC), a nationally recognized nonprofit organization established to support victims of identity crime, released its U.S. data breach findings for the first half (H1) of 2021. According to the data breach analysis, publicly-reported U.S. data breaches are up 38 percent in the second quarter (Q2) of 2021 (491 compromises) compared to the first quarter (Q1). However, the number of individuals impacted (52.8 million) is down 20 percent over that same timespan.
For H1 2021, the number of compromises (846) makes up 76 percent of 2020’s total compromises. If the current attack pace continues, the increase in data breaches in 2021 will end with a record-setting number of compromises, exceeding the current highwater mark of 1,632 set in 2017.
However, the number of victims (118.6 million) only makes up 38 percent of 2020’s total number of people impacted by data breaches, data exposures and data leaks. If the trend continues, 2021 could result in the lowest number of people impacted by data compromises since 2014.
Phishing and ransomware attacks remain the top two root causes for data compromises, and supply chain attacks continue to increase (32 new attacks in Q2 compared to 27 in Q1 2021). The surge in phishing, ransomware and supply chain attacks is driving the pace of data compromises and the main reason 2021 could see a new record for total data breaches, data exposures and data leaks.
“We are seeing a shift with the increase in data breaches in 2021 compared to 2020, primarily because of the growing number of phishing attacks, ransomware attacks and supply chain attacks,” said Eva Velasquez, president and CEO of the Identity Theft Resource Center. “While it is discouraging to see the number of compromises up, it is encouraging that we could see the fewest number of people impacted in seven years. Criminals continue to exploit organizations of all sizes through single points-of-attack, making good cyber-hygiene practices more important than ever.”
Other findings in the analysis include:
- Data compromises are rising in half of the sectors tracked by the ITRC. Manufacturing & Utilities and Professional Services are seeing significant increases, while Healthcare and Retail are seeing data compromises drop. This dynamic reflects the broader trend of cybercriminals shifting their attacks to critical infrastructure entities that are too important to remain idle, and targets with less robust cybersecurity protections in hopes of securing larger ransomware payments.
- The 58 supply chain attacks through June 30, 2021, a 19 percent increase in Q2, compares to 70 malware-related compromises, which indicates that third-party risks are poised to surpass malware as the third most common root cause of data events by the end of the year.
- The July 2, 2021 supply chain attack on Kaseya, a security software provider, also indicates that the scope and complexity of supplier attacks are increasing.
For more information about recent data breaches, or the increase in data breaches discussed in the latest trend analysis, consumers and businesses should visit the ITRC’s data breach tracking tool, notified.
For consumers who have been victims of a data breach, the ITRC recommends downloading its free ID Theft Help app to manage the various aspects of an individual’s data breach case.
Anyone can receive free support and guidance from a knowledgeable live-advisor by calling 888.400.5530 or visiting www.idtheftcenter.org to live-chat.
About the Identity Theft Resource Center
Founded in 1999, the Identity Theft Resource Center® (ITRC) is a nonprofit organization established to empower and guide consumers, victims, business and government to minimize risk and mitigate the impact of identity compromise and crime. Through public and private support, the ITRC provides no-cost victim assistance and consumer education through its website live-chat idtheftcenter.org, toll-free phone number 888.400.5530 and ID Theft Help app. The ITRC also equips consumers and businesses with information about recent data breaches through its data breach tracking tool, notified.