Half of organizations fell victim to spear phishing in 2022

The latest spear phishing trends report from Barracuda Networks shows that 50 percent of organizations studied were victims of spear-phishing in 2022, with 24 percent having at least one email account compromised through account takeover.

The report draws on a data set that comprises 50 billion emails across 3.5 million mailboxes, including nearly 30 million spear-phishing emails, as well as a survey by Vanson Bourne of IT professionals from frontline to the most senior roles at 1,350 companies.

Although spear-phishing attacks make up only 0.1 percent of all e-mail based attacks, according to Barracuda data, they are responsible for 66 percent of all breaches.

Of those respondents that experienced a spear-phishing attack, 55 percent report machines infected with malware or viruses; 49 percent having sensitive data stolen; 48 percent having stolen login credentials; and 39 percent direct monetary loss.

The report suggests remote work is contributing to the problem. Users at companies with more than a 50 percent remote workforce report higher levels of suspicious emails -- 12 per day on average, compared to nine per day for those with less than a 50 percent remote workforce. In addition companies with more than a 50 percent remote workforce also report that it takes longer to both detect and response to email security incidents -- 55 hours to detect and 63 hours to response and mitigate, compared to an average of 36 hours and 51 hours respectively for organizations with fewer remote workers.

"Even though spear phishing is low volume, with its targeted and social engineering tactics, the technique leads to a disproportionate number of successful breaches, and the impact of just one successful attack can be devastating," says Fleming Shi, CTO of Barracuda. "To help stay ahead of these highly effective attacks, businesses must invest in account takeover protection solutions with artificial intelligence capabilities. Such tools will have far greater efficacy than rule-based detection mechanisms. Improved efficacy in detection will help stop spear-phishing with reduced response needed during an attack."

The full report is available from the Barracuda site.

Image credit: artursz/depositphotos.com