Attack types

26 attack-type classifications tracked. 2,429 of 23,173 confirmed incidents currently carry an attack-type classification — most confirmed incidents on file do not yet have one assigned.

An attack type classifies how an incident happened, drawn from two different sources. Most classifications map to a MITRE ATT&CK technique, the industry-standard catalog of adversary methods; a handful (Loss, Theft, Improper Disposal, Unauthorized Access/Disclosure, Hacking/IT Incident and Unknown) are instead regulator reporting categories carried over from the source breach-notification filing, used when that filing does not describe a specific technique. A source document has to actually describe how an incident happened before Breach Census can assign it a classification.

Attack type	Confirmed incidents
Backup Destruction	0
Cloud Storage Breach	0
Code Injection	0
Credential Theft	0
Data Destruction	0
Data Exfiltration	0
Data Interception	19
Denial of Service	0
Hacking/IT Incident	1,017
Improper Disposal	1
Lateral Movement	0
Loss	0
Malware Deployment	224
Phishing Attack	112
Privilege Abuse (Insider)	0
Privilege Escalation	0
Ransomware Attack	586
SQL Injection	0
Session Hijacking	0
Social Engineering	2
Supply Chain Compromise	0
Theft	5
Unauthorized Access/Disclosure	463
Unknown	0
Unsecured Credentials	0
Web Application Exploitation	0

Questions and answers

How many attack-type classifications does Breach Census track?

26 attack-type classifications are tracked, drawn from the MITRE ATT&CK framework and from state and federal breach-notification reporting categories.

How many confirmed incidents currently carry an attack-type classification?

2,429 of 23,173 confirmed incidents on the site currently carry an attack-type classification; the rest have not yet been classified.

Which attack type has the most confirmed incidents?

Hacking/IT Incident, with 1,017 confirmed incidents.