From Past to Present: The Evolution of Data Breach Causes (2005–2025)

Abstract

This review aims to analyze the changing causes of data breaches over
two decades by synthesising evidence from various data breach
investigation reports and regulatory filings. The methodology involves
examining trends in threat actors, actions, and motives identified in
reports such as the Verizon Data Breach Investigations Report (DBIR)
series from 2008 to 2024, California Attorney General's reports, and the
Privacy Rights Clearinghouse. (1,2,3) The findings reveal an evolution
through distinct phases: an initial period (roughly 2008-2010)
dominated by external breaches leveraging hacking and malware, a
subsequent era (2011-2019) marked by the rise of sophisticated
cybercrime, including increased phishing and the emergence of defined
incident patterns, and a more recent epoch (2020-2024) characterised
by a significant surge in ransomware attacks, exploitation of
systemic vulnerabilities, and the convergence of financially motivated
and nation-state actors. Throughout these periods, human factors and
errors have consistently contributed to successful breaches. In conclusion, the landscape of data
breaches have shifted from simpler external attacks to more complex and
disruptive campaigns, where human vulnerabilities remain a key
enabler, and the emerging landscape includes AI-driven threats
that are being explored by both attackers and defenders, necessitating
continuous adaptation of defence strategies to address both traditional
weaknesses and novel AI-related risks.