Dive Brief:

• The majority of credentials and personal records stolen in 2022 were held by organizations in the information sector, which comprises software, telecommunications, data processing and web hosting, according to Flashpoint.
• Of the 22.6 billion credentials and personal records exposed or stolen by threat actors last year, 13.8 billion came from the information sector, according to Flashpoint. This accounts for 3 in 5 of all records exposed by data breaches last year.
• “This data shows that once organizations employ vendors to perform these services on their behalf, those same vendors leave sensitive customer and employee data out in the open,” Flashpoint said in its “State of Cyber Threat Intelligence” report released Thursday.

Dive Insight:

Misconfigured databases and web-based services accounted for 5% of all reported data breaches last year, but were responsible for leaking 71% of all personal records, the report found.

The number of records exposed by misconfigurations ultimately surpassed 16 billion credentials or PII by year’s end, according to Flashpoint.

“The most striking thing about misconfigurations leading to breaches and leaks is that it continues to happen at astronomical rates year to year,” Ian Gray, director of analysis and research at Flashpoint, said via email.

These breaches are attributed to misconfigurations in cloud-based infrastructure and services, public sites and search engines.

“While misconfigurations within the organization are the easiest to handle, it becomes considerably more difficult to ensure that vendors within your digital supply chain are doing the same,” Gray said.

Organizations in the information sector process or store data for many businesses and industries, compounding downstream risk when they experience data breaches and leaks. Flashpoint’s threat intelligence platform observed 4,518 data breaches last year.