Stolen credentials the leading cause of cyber breaches in 2023

Stolen credentials through phishing attacks were the most common cause of cyber breaches among UK businesses last year, a new

Facebook
LinkedIn
X

Stolen credentials through phishing attacks were the most common cause of cyber breaches among UK businesses last year, a new study has revealed.

Cybersecurity firm IDEE commissioned an independent survey of more than 500 IT and cybersecurity professionals within UK businesses. It found that 61%) of businesses experienced a cyber breach in 2023, with 25% suffering three or more.

When asked to name the cause or causes of their most recent breach, 35% said it was the result of stolen credentials (passwords, tokens, etc.) through phishing attacks, making it the most common reason. The next most frequently selected factor with 29% was ‘a vulnerability that was not patched by their cyber security solution’.

The data also raises questions about the efficacy of password-based Multi-Factor Authentication (MFA) solutions, with 23% indicating that their MFA solution was bypassed or compromised in their latest breach. The same number (23%) suffered a breach due to a backdoor attack (malware that sidesteps authentication procedures to gain access).

Al Lakhani, CEO of IDEE, said: “The data perfectly encapsulates the fundamental flaw behind so many MFA solutions: they are password reliant.

“The cyber industry’s ‘best’ solutions in recent years have tried to bolster security with additional authentication factors like OTPs, push notifications, or QR codes, but these methods remain tethered to centrally stored passwords and are therefore susceptible to phishing attacks. Consequently, businesses continue to suffer breaches and account takeovers because they focus on detection rather than actually preventing the breach in the first place.

“Businesses’ dependence on password-reliant MFA is a case of herd mentality. It’s time to stop following others and embrace solutions rooted in transitive trust and robust identity proofing. Hopefully this research acts as a wake-up call for cyber teams across the country.”

Related Stories from Silicon Scotland

Cyber security and AI fuelling growth in IT spending, says Forrester
Cybersecurity experts come together for Cyber Scotland 2025 in Aberdeen
ransomware attacks on the rise
Ransomware attacks soar as new cybercrime groups reshape threat landscape in 2025
uk requests apple access
UK Allegedly Demands ‘Backdoor’ to All Apple Encrypted Data
boost uk cyber defence recruitment
UK Armed Forces launch fast-track cyber warrior recruitment to counter rising digital threats
Third-party Attack Vectors Plague Insurance Companies

Other Stories from Silicon Scotland