Social Engineering
2 confirmed incidents.
VERIS: social:PretextingMITRE ATT&CK: T1597 (Search Closed Sources)T1598 (Phishing for Information)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Social engineering covers an attack that manipulates a person, rather than a system, into taking an action that leads to exposure, impersonating a colleague or vendor by phone, for example, to get a password reset or a wire transfer approved. It maps to two MITRE ATT&CK techniques: T1597 (Search Closed Sources), researching a target using purchased or otherwise non-public information to make the pretext convincing, and T1598 (Phishing for Information), the direct ask for information once the pretext is in place. Unlike the narrower Phishing classification, this one covers pretexting carried out by phone, in person, or through channels other than a phishing message.
Top organizations
| Organization | Confirmed incidents |
|---|---|
| AdaptHealth Corp. | 1 |
| Apollo Management Holdings, L.P. | 1 |
Recent incidents
| Organization | Disclosed | Jurisdiction | Records affected |
|---|---|---|---|
| Apollo Management Holdings, L.P. | August 20, 2026 | US-CA | — |
| AdaptHealth Corp. | July 2, 2026 | US | 4,115,802 |
Questions and answers
How many confirmed incidents are classified as Social Engineering on Breach Census?
2 confirmed incidents are currently classified as Social Engineering.
Which organization has the most confirmed Social Engineering incidents?
AdaptHealth Corp., with 1 confirmed incidents classified this way.
Which MITRE ATT&CK techniques does the Social Engineering classification cover?
This classification maps to MITRE ATT&CK techniques T1597 (Search Closed Sources), T1598 (Phishing for Information).
What counts as a confirmed incident for the Social Engineering classification?
An incident counts here once it carries the Social Engineering attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.