2025 Verizon DBIR: Why Devaluing Data Stops Breaches

The 2025 Verizon Data Breach Investigations Report (DBIR) – a comprehensive analysis of over 22,000 security incidents and 12,195 confirmed breaches – marked the largest dataset in the report’s history. This year’s findings spotlight escalating threats tied to third-party breaches, credential abuse, ransomware, and the human element – providing a sobering look at today’s most pervasive attack vectors.

What the DBIR Reveals – and How to Fix It

1. Credential Abuse Remains Prevalent

Stolen credentials continue to be a primary access vector, present in 22% of breaches. Of particular concern, 88% of basic web application attacks involved compromised credentials – often acquired through phishing or malware.

The Fix: Strengthen identity and access management (IAM), implement multi-factor authentication, and continuously monitor for exposed credentials on the dark web.

2. Ransomware Attacks Surge

Ransomware appeared in 44% of breaches, up 37% from last year. While attackers remain relentless, there’s progress: 64% of affected organizations refused to pay, and the median ransom dropped to $115,000—signaling improved defenses and recovery planning.

The Fix: Building resilience includes regular backups, network segmentation, and tested incident response strategies.

3. Human Element Remains a Major Risk

Human error, social engineering, and insider misuse contributed to 60% of breaches. Encouragingly, the report notes that organizations with regular security training saw phishing reporting rates improve fourfold.

The Fix: Security awareness and education isn’t optional—it’s essential.

4. Exploitation of Vulnerabilities Increases

Exploiting known and unknown vulnerabilities accounted for 20% of breaches—a 34% increase over the previous year. Attackers continue to target unpatched perimeter devices, VPNs, and zero-day flaws.

The Fix: Consistent patch management and vulnerability scanning are key to reducing attack surfaces.

5. Espionage-Driven Breaches Climb

Espionage-motivated attacks now make up 17% of breaches, particularly within the Manufacturing and Healthcare sectors. These industries often hold high-value data that is attractive to state-affiliated actors.

The Fix: Protecting intellectual property requires a layered defense strategy and data governance protocols.

6. Risks from Unmanaged Devices and AI Usage

The report highlights growing risk from unmanaged devices and AI tools. 14% of employees used generative AI services on work devices—72% of them via personal emails—introducing dangerous blind spots for security teams.

The Fix: Endpoint visibility, controls around personal devices, and data usage policies must evolve in tandem with employee habits.

7. The Most Urgent Threat: Third-Party Data Breaches

The most alarming trend in this year’s report? A 100% year-over-year increase in third-party involvement—30% of all breaches now stem from partners, vendors, or supply chain relationships.

These breaches are uniquely dangerous because third parties often hold sensitive data but lack internal oversight. Once compromised, attackers can move laterally into the primary organization’s environment, exploiting vulnerabilities in these relationships – often through exposed credentials, outdated software, or unsecured APIs.

In a recent BankInfoSecurity interview, Chris Novak, Managing Director at Verizon Cybersecurity Consulting, emphasized that many organizations fail to apply the same security rigor to their partners and vendors as they do internally. This oversight leaves open doors that bad actors are quick to exploit.

The Fix: While other threats mentioned in the DBIR focus on strategies that defend systems against attacks on valuable data, the report itself is evidence that data breaches have and will continue to happen. This is where data-centric security becomes non-negotiable – devaluing data is essential.

By implementing PCI-validated point-to-point encryption (P2PE) and tokenization, businesses can ensure sensitive data – like payment information and PII – is encrypted at the point of capture and rendered useless to attackers through secure tokenization. These tools effectively reduce the value of breached data, even if it falls into the wrong hands.