by Brian Thompson | Jun 17, 2026 | Breach, Employee Benefits, Identity Theft
Constella Intelligence is one of the companies that powers many of the identity protection services operating in the U.S. today. Every quarter they publish a breach report drawn from their global monitoring network. Their Q1 2026 data breach report covers January through March 2026, and the numbers are worth paying attention to if you have employees.
Here is what the report found, in plain terms.
Criminals stole a staggering amount of data in just three months
In the first quarter of 2026, Constella tracked more than 229,000 breach events across the open web, dark web, and underground forums. After filtering out duplicates and low-quality data, investigators confirmed 3,685 of those as real incidents containing usable identity information. Those breaches produced 9.73 billion verified records.
For comparison: Constella confirmed 8,460 total breaches across all of 2025. The 2026 pace is running nearly double that.
The odds that at least one of your employees has personal data sitting in that pool are not low. They are close to certain.
It is not just passwords being stolen anymore
This is the part that matters most for HR and benefits teams.
The largest category of Q1 breaches came from direct attacks on primary databases: government systems, telecom providers, financial institutions. These are not recycled credential lists. They are fresh records pulled from the source. In fact, 95% of those breaches contained more than just a username and password. Attackers walked away with phone numbers, home addresses, national ID numbers, and financial account details all bundled together.
That is a complete identity profile. Criminals do not need to piece it together from multiple sources. It comes pre-assembled.
One more number worth sitting with: companies holding your employees’ data stored 42% of those breached passwords in plain text. No encryption. No protection. Anyone who accessed those databases got working credentials instantly.
Your employees did everything right and still got exposed because someone else did not.
There is a type of attack most employees have never heard of
The second major finding in the report involves something called infostealers. Most non-technical people have never encountered this term, so here is a plain-language explanation.
An infostealer is a type of malware that runs quietly in the background on an infected computer. It does not lock files or demand a ransom. Instead, it copies every saved password, every active login session, and every stored credential from the device and sends that data to whoever deployed it. Then it disappears.
In Q1 2026, Constella processed 31.6 million of these stolen data packages, pulled from 2.77 million infected devices worldwide.
Why does this matter for your employees specifically? Two reasons. First, infostealers capture active session data, not just passwords. As a result, even accounts protected by two-factor authentication can fall to this attack. Changing the password afterward does not fix it. Second, employees who use personal devices for any work-related task, or whose family members share a home computer, have no corporate IT protection against this. In other words, it is a household risk, not just a workplace one.
The sectors hit hardest are ones your employees use every day
Finance and retail led Q1 breach counts. Government databases came in third. Healthcare was in the top ten.
These are not fringe platforms. They are banks, online stores, insurance portals, and benefits systems. The top five individual breaches of the quarter hit a data broker, a streaming service, a car marketplace, a retail chain, and a shipping company. Combined, those five incidents alone exposed 270 million records.
Every account your employees have ever created is a potential exposure point. Not because of anything they did, but because of how the companies holding their data chose to protect it.
What this means if you are evaluating identity protection as a benefit
The argument for offering identity protection as an employee benefit used to center on awareness and vigilance. Teach employees to spot phishing. Use strong passwords. Enable two-factor authentication. That advice is still worth giving. But the Q1 2026 data breach report makes clear it is not enough on its own.
Today, employers expose employees through breaches at companies those employees trusted years ago. The stolen data is complete enough to open new accounts, file fraudulent tax returns, and take over existing financial accounts. Additionally, the methods attackers now use, like infostealers, bypass the standard defenses most individuals have in place.
Monitoring, early alerting, and professional recovery support are not a luxury add-on. They are the difference between catching a problem in week one and finding out six months later when the damage is done.
If you are still on the fence about whether identity protection belongs in your benefits package, Q1 2026 answers the question plainly. The risk is real, it is growing, and it is landing on ordinary employees.
Learn more about how identity theft protection works as an employee benefit, or review our small business post-breach playbook for what to do if your company is affected. For a closer look at the attack methods behind these numbers, see our guides on phishing and third-party data breaches.
Source: Constella Intelligence, Q1 2026 Quarterly Breach Report. All statistics in this article come directly from that report. Full methodology available at constella.ai.
by Brian Thompson | May 14, 2026 | Breach, Employee Benefits, Identity Theft
Last Updated: May 2026 | Reading time: ~10 minutes
Most small business owners assume they are not interesting enough to target. Ransomware operators are counting on that assumption. In 2025, ransomware attacks on small and midsize businesses jumped 34%, and 88% of all ransomware incidents now involve organizations with fewer than 500 employees. The businesses that got hit were not unlucky. They were accessible.
The shift happened years ago, but the data is now undeniable. Attackers stopped picking targets manually. Automated tools scan the internet constantly for unpatched software, weak passwords, and open remote desktop ports. When a scan finds one, the attack launches. No human reviewed your company profile. No one weighed whether you were worth the effort. The algorithm found a door that was not locked, and someone walked in.
Why Small Businesses Are Ransomware’s Primary Target in 2026
Three factors put small businesses at the center of the ransomware economy.
First, the economics favor volume. Ransomware-as-a-Service (RaaS) platforms operate like software businesses: developers build the attack toolkit, affiliates license it and find targets, and the group splits the ransom proceeds. For affiliates working on commission, a $50,000 payout from a 30-employee distribution company is more attractive than a months-long campaign against a hardened enterprise. When you can hit 100 small businesses in the time it takes to breach one Fortune 500 firm, the math favors targeting SMBs.
Second, small businesses carry more valuable data than most owners realize. Employee payroll records contain Social Security numbers, direct deposit account details, and home addresses. Benefits files include health insurance data and dependent information. Customer databases hold payment credentials and purchasing history. That data has real resale value on criminal marketplaces, independent of any ransom payment.
Third, the defenses are thin. Most small businesses run on a mix of consumer-grade tools, default configurations, and one or two generalist IT contacts already managing too many other priorities. There is no dedicated security operations center, no incident response plan, and often no tested backup system. For ransomware operators, that is not a deterrent. It is a feature.
How a Ransomware Attack Unfolds
The median time from initial access to encryption in 2025 was five days. That is a narrow window to catch an intruder before serious damage is done.
Days 1 to 2: Initial access. The attacker gets in. In 32% of 2025 ransomware incidents, the entry point was an exploited software vulnerability. For 23%, it was compromised credentials, often purchased from a broker who harvested them through earlier phishing campaigns. In the remainder, phishing delivered directly to an employee was the entry point. For more on how phishing tactics have evolved, see AI-Powered Phishing Attacks: How Generative AI Is Changing Scams.
Days 2 to 4: Reconnaissance and movement. Once inside, the attacker moves quietly. They map the network, identify backup locations, and search for administrative credentials that expand their access. This is also when data exfiltration begins. In a double extortion attack, which is now the standard approach, attackers copy sensitive files before encrypting anything. Those files become the second lever: if the business refuses to pay for the decryption key, the attacker threatens to publish or sell the stolen data.
Day 5 or sooner: Encryption. The ransomware executes. Files are locked. Systems go dark. A demand appears. The average downtime following a ransomware attack is 24 days. For a business that cannot process orders, access customer records, or run payroll for three weeks, 24 days is often enough to cause permanent damage. A Mastercard survey of more than 5,000 SMB owners found that nearly one in five businesses that experienced a cyberattack went bankrupt or closed entirely.
The Hidden Cost Most Owners Miss: Employee Identity Theft
This is the section most ransomware guides skip. It is also where the damage from a successful attack extends furthest beyond the business itself.
When attackers exfiltrate data in a double extortion attack, employee records are among the most valuable files they take. Payroll systems contain Social Security numbers. Benefits platforms hold dependent information, medical plan details, and in some cases, banking credentials for direct deposit. HR files include home addresses, dates of birth, and emergency contact information. On dark web marketplaces, a complete employee profile commands considerably more than a single credit card number.
The problem compounds over time in a way most businesses do not anticipate. After a ransomware attack, the standard response is to offer affected employees one or two years of free credit monitoring. That offer satisfies the legal notification requirement in most states and closes the internal response. But the stolen data does not expire.
According to Javelin Strategy & Research’s 2026 Identity Fraud Study, Americans lost $27.3 billion to traditional identity fraud in 2025. Critically, the timing of fraud does not always align with the breach that enabled it. A Social Security number stolen in a 2024 ransomware attack may not surface in fraudulent tax filings, new account applications, or benefit claims until 2026 or 2027. By then, the two-year monitoring offer has expired. The employee has no protection in place. The fraud lands without warning.
This is where employer-provided identity theft protection closes a real gap. Ongoing monitoring, not a time-limited post-breach offer, is the only defense that covers the delayed-use pattern now documented in fraud data. For small businesses, offering identity protection as an employee benefit means that when a ransomware attack exposes workforce data, employees have active coverage already in place. They do not wait for a monitoring offer to arrive. The protection is already running.
How Ransomware Gets In: The Three Entry Points
Understanding the primary entry points helps prioritize where to focus limited time and budget.
Exploited vulnerabilities. Unpatched software and outdated systems are the most common technical entry point, accounting for 32% of 2025 ransomware incidents. This includes known vulnerabilities in remote access tools, VPN appliances, and file-sharing platforms. Attackers use publicly available exploit code. If a vendor released a patch and your team has not applied it, the window is open.
Compromised credentials. Stolen usernames and passwords, purchased from credential brokers or obtained through phishing, account for 23% of attacks. Once an attacker has valid credentials for a remote desktop connection or a cloud application, they authenticate normally. No technical exploit is required. Multi-factor authentication (MFA) stops most credential-based attacks before they begin. See Password Best Practices: How to Create Strong Passwords That Actually Protect You for a practical starting point.
Phishing. A convincing email delivers a malicious attachment or a link that installs malware when clicked. AI-generated phishing messages have made this category significantly more dangerous in 2026. Attackers now use language models to write personalized, grammatically correct messages that mimic the style and context of legitimate business communication. An employee receiving an email that appears to come from their payroll provider or a familiar vendor has very little to signal that something is wrong.
What to Do Before, During, and After a Ransomware Attack
Before: Three Controls That Prevent Most Attacks
Most ransomware attacks exploit the absence of a small number of basic controls. Three are worth prioritizing above everything else.
Multi-factor authentication on every remote access point and cloud application. This single control stops the majority of credential-based attacks. If an attacker has a stolen password but cannot produce the second factor, authentication fails. MFA is not optional in 2026 for any system accessible from outside your office network.
A tested, isolated backup strategy. Backups only matter if they work when you need them and if they are isolated from the systems the attacker can reach. Backups connected to the same network can be encrypted alongside everything else. Offline or separately credentialed cloud backups survive an attack intact. Test restoration quarterly, not annually.
A patching discipline. Critical vulnerabilities in remote access tools, VPN appliances, and email platforms should be addressed within days, not weeks. The ransomware groups tracking these vulnerabilities move faster than most SMB IT schedules.
For a broader security posture framework, 10 Essential Security Policies for Small Businesses and Remote Work Security Best Practices cover the controls that matter most for lean teams.
During: Four Decisions That Matter in the First Hour
When ransomware executes, the decisions made in the first hour shape everything that follows.
Isolate affected systems immediately. Disconnect infected machines from the network to stop lateral spread. Do not power them off completely. Encrypted memory may contain forensic evidence that helps investigators identify the ransomware variant and reconstruct the attack path.
Do not pay without professional advice. Payment does not guarantee decryption. In some cases, payment may violate sanctions regulations if the ransomware group is on a government watchlist. Contact a qualified incident response firm before any payment decision.
Notify your insurance carrier. Most cyber insurance policies require prompt notification and carry specific response protocols. Acting outside those protocols can affect coverage.
Preserve evidence. Law enforcement and forensic investigators need logs, captured memory, and system images. Wiping or restoring systems prematurely limits what investigators can reconstruct and may complicate any insurance claim.
After: The Employee Notification and Protection Gap
When employee data has been exfiltrated, the obligation extends to the people whose information was taken. State breach notification laws require timely disclosure, and the specifics vary by jurisdiction. Beyond legal compliance, employees need practical protection, not just a letter explaining what happened.
Offering one to two years of credit monitoring is the common response and often the legal minimum. Given the delayed-use pattern in current fraud data, it may not be enough. Building ongoing identity protection into your employee benefits package closes that gap before the next incident occurs, not after. For a detailed step-by-step response framework covering the critical first 48 hours, see the Small Business Post-Breach Playbook: What to Do First.
For context on how similar risks play out through vendor and supply chain exposure, Third-Party Data Breach: SMB Survival Guide for 2026 covers that angle in full.
Ransomware and Small Business: Frequently Asked Questions
What is ransomware and how does it affect small businesses?
Ransomware is malicious software that encrypts a business’s files and demands payment for the decryption key. Modern ransomware attacks also steal data before encrypting it, creating a second threat: the release or sale of sensitive business and employee information. Small businesses are disproportionately affected because they typically have weaker defenses, fewer resources for recovery, and less ability to absorb the financial impact of extended downtime.
How common are ransomware attacks on small businesses?
Ransomware accounts for 88% of all SMB data breach incidents. In 2025, ransomware attacks increased by 34% overall, and U.S. incidents rose 50% in the first ten months of the year alone. Experts estimate that 85% of attacks go unreported, meaning the true number is significantly higher than official statistics reflect.
What is double extortion in a ransomware attack?
Double extortion is the practice of stealing data from a target before encrypting it. Attackers then make two demands: pay to receive the decryption key, and pay again (or instead) to prevent the stolen data from being published or sold. Double extortion is now the standard approach for most ransomware groups because it creates leverage even when a business has reliable backups.
Should a small business pay a ransomware demand?
Most cybersecurity and law enforcement agencies advise against paying ransoms. Payment does not guarantee that decryption keys will be provided or that stolen data will not be released anyway. There are also legal risks: some ransomware groups are on government sanctions lists, and payment may constitute a violation of sanctions regulations. Any payment decision should involve a qualified incident response professional and legal counsel before proceeding.
How does a ransomware attack lead to employee identity theft?
When attackers exfiltrate data in a double extortion attack, employee files are among the most valuable targets. Social Security numbers, payroll records, banking details, and benefits information can be sold on criminal marketplaces or used directly for fraud. The fraud often does not occur immediately. Stolen SSNs are frequently weaponized months or years after the original breach, after any monitoring offered by the employer has expired. Ongoing identity protection, rather than a time-limited monitoring offer, is the only defense that covers this delayed-use pattern.
What is Ransomware-as-a-Service (RaaS)?
Ransomware-as-a-Service is a criminal business model in which ransomware developers license their attack tools to affiliates, who then identify targets and carry out attacks in exchange for a percentage of ransom proceeds. RaaS has significantly lowered the technical skill required to conduct ransomware attacks and increased the volume of actors targeting small businesses. It is one of the primary reasons ransomware attacks on SMBs have grown so rapidly in recent years.
How long does recovery from a ransomware attack take?
The average downtime following a ransomware attack is 24 days. Total recovery, including system rebuilding, forensic investigation, legal and regulatory response, and reputational repair, typically takes much longer. Businesses with tested, isolated backup systems and documented incident response plans recover significantly faster than those without. Planning before an attack occurs is the most reliable way to reduce recovery time.
When a ransomware attack exposes employee data, the fraud that follows does not always come immediately. Defend-ID gives employees active, ongoing identity protection so that when stolen data surfaces months or years later, someone is already watching for it. Learn more at defend-id.com.
by Brian Thompson | May 7, 2026 | Breach, Identity Theft
Last Updated: May 2026 | Reading time: ~11 minutes
A third-party data breach is no longer an enterprise problem that occasionally splashes onto small businesses. In a single 30-day window this spring, McGraw-Hill, Adobe, Vimeo, and ADT all disclosed breaches that exposed customer or employee data. None of these companies was the original target. Each one was breached because a vendor in their supply chain was compromised first.
That is the new shape of cyber risk. Attackers are no longer hammering on the front door. They are walking in through Salesforce environments, payroll providers, BPO contractors, marketing platforms, and benefits administrators that small and mid-sized businesses already trust and pay for. According to Verizon’s 2025 Data Breach Investigations Report, third-party involvement in breaches doubled in a single year, climbing from 15% to 30% of all breaches analyzed. The 2026 DBIR confirms the trend has not reversed.
If you run a small business, this is the breach you most need to plan for, because it is the one you have the least power to prevent. The good news: a third-party data breach is survivable when you know what to do before, during, and after one happens.
What just happened: a 30-day timeline of vendor breaches in 2026
The recent string of incidents is not random. They share a pattern, and the pattern matters more than any single breach.
- McGraw-Hill (April 14, via Salesforce): The ShinyHunters extortion group dumped more than 100 GB of McGraw-Hill data publicly after a ransom deadline expired. The root cause was not a zero-day exploit. It was a Salesforce Experience Cloud misconfiguration that left guest user permissions too permissive and the underlying API endpoint queryable. The Dutch Institute for Vulnerability Disclosure later confirmed this was a systemic issue affecting any organization that had not properly locked down Salesforce guest access.
- Adobe (April 3, via a contractor): A threat actor calling himself “Mr. Raccoon” claimed access to roughly 13 million Adobe support tickets, 15,000 employee records, and HackerOne submissions. Reports indicated the intrusion likely began with a phishing email sent to a contractor at an Indian business process outsourcing (BPO) vendor, then expanded through a manager account.
- Vimeo (April, via Anodot): Vimeo customer data was exposed when ShinyHunters compromised Anodot, a third-party business monitoring service Vimeo used. Vimeo itself was never breached.
- ADT (April): The same actor group hit ADT with ransomware. Investigation pointed to compromised vendor access as a likely vector.
- Adidas (February 16, via a licensing partner): A threat actor using the name “LAPSUS-GROUP” posted a claim of access to the Adidas Extranet, with roughly 815,000 rows including names, emails, passwords, and birth dates. Adidas confirmed the data appears to have come through reseller and licensing partner accounts, not its core systems.
Different attackers are attacking different industries and geographies. One common thread: the breached organization did not own the door the attacker walked through.
Why third-party data breaches are now the #1 SMB risk
Large enterprises have entire teams running third-party risk management programs. Small businesses have, at best, a procurement spreadsheet. That gap is exactly why attackers have shifted their attention. A small or mid-sized business is a soft target not because of what it builds, but because of what it buys.
Three numbers explain the scale of the problem:
- 30% of all data breaches now involve a third party, double the 2024 figure (Verizon 2025 DBIR).
- Small businesses represent 48% of all breaches involving high-risk data such as Social Security numbers, financial credentials, or authentication tokens (Proton Data Breach Observatory, 2026).
- 65% of large companies say third-party and supply chain risk is their biggest cyber resilience barrier. If it is the biggest barrier for organizations with full security teams, it is an even bigger barrier for businesses without one (World Economic Forum Global Cybersecurity Outlook 2026).
The economics also work in the attacker’s favor. Why phish 1,000 small businesses one at a time when a single compromise of a payroll vendor, an HRIS platform, or a marketing automation tool exposes thousands of small businesses at once? The 2026 attacks above are not isolated incidents. They are the natural endpoint of an attack model that scales.
How a third-party data breach actually exposes your business and your employees
A third-party data breach hits a small business in three distinct ways, and most owners only think about the first one.
1. Operational disruption
If your payroll vendor is down, you cannot run payroll. Your CRM is compromised, your sales team is flying blind. If your benefits administrator is offline, employees cannot access plan information during open enrollment. Operational dependency is the visible cost. It is usually the smallest of the three.
2. Direct data exposure
Whatever data you sent to that vendor is now potentially in attacker hands. Customer lists, employee records, health information, financial details, login credentials. You no longer control where that data goes or how it is used. According to IBM’s 2025 Cost of a Data Breach Report, the global average cost of a breach is now $4.4 million. Breaches involving cloud and SaaS environments tend to run higher and take longer to contain.
3. Employee identity exposure
This is the one most small businesses underestimate. When a benefits administrator, payroll provider, or HRIS platform is breached, your employees’ personal data is in the wild: Social Security numbers, addresses, dates of birth, dependent information. Your employees did not choose that vendor. You did. The morning after the breach hits the news, they will be at your door asking what you are going to do about it.
This is the moment when an identity theft protection benefit shifts from “nice to have” to “the only thing standing between us and a very angry workforce.” Employees who have monitoring, recovery services, and identity insurance in place have somewhere to go. Employees who don’t have one resource: their employer.
What to do BEFORE a third-party data breach: a 5-step prevention playbook
You cannot prevent a vendor from being breached. You can dramatically reduce the blast radius when one is.
1. Build a vendor inventory
Most small businesses cannot list every SaaS tool, contractor, and data processor that touches their business data. Build the list. Include the vendor name, the data shared, where the data is stored, and a primary contact. If you cannot do this in a single afternoon, you have already discovered the problem.
2. Tier vendors by risk
Not every vendor is equal. A vendor that holds employee Social Security numbers, customer financial data, or production system access is a Tier 1 vendor. A vendor that holds marketing copy is not. Spend your security attention proportionally. Most small businesses spread it evenly and run out of energy before they reach the vendors that actually matter.
3. Demand contractual breach notification
Your contracts with Tier 1 vendors should require breach notification within a defined window, typically 24 to 72 hours of discovery. Many small business vendor contracts are silent on this. If yours are silent, your vendor’s lawyers will decide when, how, and whether to tell you. Move that decision back into your contracts.
4. Limit access by default
Most vendor breaches expand because the compromised account had access to far more than the vendor needed. Apply least-privilege principles to vendor access just as you would to employee access. Disable shared logins. Require multi-factor authentication on every vendor portal. Rotate credentials when staff turns over.
5. Build vendor breach response into your incident plan
Most incident response plans assume the breach happened to you. Add a separate playbook for vendor-originated incidents that covers who notifies employees, what credit and identity protection you offer, what your legal exposure looks like, and how you communicate with customers. The middle of an incident is the wrong time to draft this.
What to do WHEN it happens: your first 72 hours
You will get the news one of two ways: directly from the vendor (the lucky case) or by reading about it in a news report or seeing it on a leak forum (the common case). The clock starts in either scenario.
Hour 0 to 24: Confirm the scope. What data did you share with this vendor? What of yours is potentially exposed? Identify the Tier 1 employees and customers whose data was likely included. Pull contracts and breach notification clauses. Loop in legal counsel and your cyber insurance carrier; both calls should happen the same day.
Hour 24 to 48: Notify employees and customers honestly. Most state breach notification laws require timely disclosure when personal information is involved. California’s SB 446 now requires individual notification within 30 days of discovery, and Oklahoma’s SB 626 expanded the definition of personal information to include government-issued ID numbers and biometric data. Other states are following. Even when you are not legally required, employees expect prompt, plain-language communication.
Hour 48 to 72: Activate response services. If you have an identity theft protection benefit in place, employees can call directly and start recovery. If you don’t, this is the moment to provide one, at minimum to the affected group. Document everything: the timeline, the vendor’s communications, your responses, and the support you provided.
For a deeper response framework that applies to direct breaches as well as vendor-originated ones, see our Small Business Post-Breach Playbook.
The bottom line for SMB owners
Third-party data breaches are not an enterprise problem that occasionally splashes onto small businesses. They are now the dominant breach pattern, and small businesses are disproportionately on the receiving end. You will not prevent every third-party data breach. You can decide in advance whether the next one is a survivable disruption or an existential event.
The companies that handle vendor breaches well share a few traits: they know which vendors hold their data, their contracts have teeth, their access is tightly scoped, their response plans include vendor-originated incidents, and their employees have identity protection in place before they need it.
The ones that handle them badly are still trying to figure out who their vendors are while the news cycle decides for them.
Frequently asked questions about third-party data breaches
What is a third-party data breach?
A third-party data breach happens when an attacker compromises a vendor, contractor, or service provider that holds your data, and your data is exposed as a result. Your own systems may never be touched, but your customers, employees, or operations are still affected. Common third parties include payroll providers, benefits administrators, CRM platforms, marketing tools, and BPO contractors.
Am I legally liable when my vendor has a data breach?
In most U.S. states, the organization that owns the data (not the vendor that processed it) bears the primary notification obligation when personal information is exposed. That means even if the breach happened at your vendor, you are typically the one required to notify affected individuals and regulators. Cyber insurance and well-written vendor contracts can shift some financial exposure, but the legal duty to notify usually stays with you.
How fast do I have to notify employees after a vendor breach?
It depends on which states your employees live in. California’s SB 446 requires individual notification within 30 calendar days of discovering a reportable breach as of January 1, 2026. Other states use language like “without unreasonable delay.” Federal rules apply on top of state rules in regulated industries like healthcare and finance. As a practical matter, faster is almost always better, both legally and reputationally.
How do I evaluate a vendor’s security before I sign?
Ask for their SOC 2 Type II report or equivalent independent assessment. How they segment customer data, how they handle authentication, and what their incident notification commitments look like. Ask what happens to your data if you terminate the contract. If a Tier 1 vendor cannot answer these questions clearly, that itself is your answer.
What is the difference between a third-party breach and a supply chain attack?
The terms overlap, but they are not identical. A third-party data breach is when a vendor or processor is compromised and your data is exposed as a result. A supply chain attack is when an attacker compromises a software or service provider specifically to use it as a delivery vehicle to reach the provider’s customers. The SolarWinds attack is the classic example. All supply chain attacks are third-party events; not all third-party breaches are supply chain attacks.
Does cyber insurance cover vendor-originated breaches?
Most modern cyber policies do, but coverage varies sharply. Some policies require specific endorsements for third-party incidents. Some have lower sub-limits for breaches that originate at vendors. Read your policy before an incident, not after. Your broker should be able to walk you through exactly what is and is not covered.
How does identity theft protection help when a vendor is breached?
When employee data is exposed in a vendor breach, employees face the same risks as victims of any other breach: fraudulent accounts opened in their names, stolen tax refunds, drained bank accounts, medical identity theft. Identity theft protection programs provide ongoing monitoring, alerts when their data appears on the dark web, recovery services if fraud occurs, and identity theft insurance to cover related expenses. Offering it as an employer-paid or voluntary benefit means employees have somewhere to turn the moment a breach is announced, instead of turning to you with questions you may not be able to answer.
Protect your business and your team from breaches you can’t prevent
You cannot stop a vendor from being breached. You can decide whether your employees face the next breach alone, or with a recovery team already in their corner. defend-id provides identity theft protection as an employee benefit, with U.S.-based Recovery Advocates who handle the work for victims start to finish. When the next vendor breach hits the news, your team has somewhere to call.
Related Articles
by Brian Thompson | Apr 22, 2026 | Breach, Identity Theft, Scams
Last Updated: April 2026 | Reading time: ~10 minutes
You already know not to click suspicious links in email. Smishing attacks, however, phishing delivered by text message, now account for 35% of all phishing attempts and grew 40% year-over-year in 2025. (SentinelOne 2026; Keepnet 2025)
Email spam filters have gotten sharper, but your text inbox is wide open. Text messages carry a 98% delivery rate, and smishing click-through rates reach as high as 36%, nearly three times the average for email phishing. (Keepnet Labs 2026)
This guide explains exactly how smishing works in 2026, what the newest attack types look like, how to spot one before you click, and what your business should do about it.
Table of Contents
- What Is Smishing?
- Why Smishing Works So Well
- Smishing by the Numbers (2025-2026)
- The Most Common Types of Smishing Attacks
- How AI Is Making Smishing More Dangerous
- Real-World Smishing: The Toll Scam Surge
- How to Recognize a Smishing Text
- How to Protect Yourself and Your Employees
- How to Report a Smishing Attempt
- Frequently Asked Questions
What Is Smishing?
Smishing, short for SMS phishing, is a cyberattack delivered by text message. Rather than targeting your email inbox, criminals send fraudulent texts designed to trick you into clicking a malicious link, revealing personal information, downloading malware, or authorizing a fraudulent payment.
The word combines “SMS” (the protocol that powers text messaging) and “phishing” (the practice of baiting victims into handing over sensitive data). At its core, it uses the same manipulation as email phishing, just on a channel where most people’s guard is lower and spam filters are weaker.
Most smishing messages impersonate someone you trust: your bank, the IRS, a package carrier, your employer, or a government agency. Attackers create urgency, then give you one easy action to take, usually a link to click or a number to call.
Why Smishing Works So Well
Smishing exploits a simple psychological truth: most people trust text messages more than email. When a text arrives from what looks like your bank or your delivery carrier, the instinct is to treat it as legitimate and respond quickly.
Three structural advantages make smishing especially effective:
- No spam filters. Email providers run billions of messages through threat detection algorithms daily. Your SMS inbox has almost none of that protection, so messages land directly and unfiltered.
- Small screens hide red flags. On a mobile screen, URLs get truncated. A link to
bankofamerica-secure-login.xin may appear as nothing more than a short string, and the visual cues that tip people off on desktops become invisible on phones. According to Zimperium’s 2024 research, 83% of phishing websites are now designed specifically for mobile screens.
- The channel feels personal. Email inboxes are crowded with marketing and spam. A text from a recognizable sender name, whether your bank, your employer’s payroll provider, or the IRS, arrives in a space normally reserved for people you actually know. That familiarity compresses the time between reading and acting.
Only 36% of Americans can correctly define what smishing is, according to Proofpoint data. Nearly two out of three people don’t know the threat exists by name, let alone know how to identify it.
Smishing by the Numbers (2025-2026)
| Statistic |
Source |
| Smishing accounts for 35% of all phishing attacks |
SentinelOne, 2026 |
| SMS-originated scams grew 40% from 2024 to 2025 |
Barclays / Keepnet, 2025 |
| 19% of breaches now originate from smishing or vishing combined |
Verizon DBIR, 2025 |
| Smishing click-through rates reach up to 36% |
Keepnet Labs, 2026 |
| Americans lost $470 million to text scams in 2024, a fivefold increase from 2020 |
FTC, 2025 |
| FBI IC3 received 59,271 toll-related smishing complaints in 2024 alone |
FBI IC3, 2025 |
| 83% of phishing websites are now designed for mobile screens |
Zimperium, 2024 |
| Smishing attacks grew to 39% of mobile threats in 2026 |
Keepnet, 2026 |
| Average financial loss per smishing victim: ~$800 |
Keepnet / industry average |
The trajectory is clear. Smishing is no longer a niche threat. It’s a primary attack vector growing faster than most organizations’ defenses can keep pace with.
The Most Common Types of Smishing Attacks
1. Credential-Stealing Texts
A message arrives claiming your bank account is locked, your PayPal password needs resetting, or your employer’s HR portal requires immediate verification. The link leads to a fake login page that looks nearly identical to the real thing. Once you enter your credentials, attackers capture them instantly, often in real time, with automated tools that relay stolen information to a live operator.
Workplace accounts are frequent targets. A smishing message disguised as an IT security alert or payroll notification can hand an attacker access to company systems before anyone realizes what happened.
2. Delivery and Package Notification Scams
One of the most persistent smishing formats involves a text claiming USPS, FedEx, or UPS has a package requiring your attention. You’re asked to “confirm your address” or “pay a small customs fee,” and the link harvests your payment details and personal information. These scams are especially effective because most people have packages in transit at any given time.
3. Toll and Government Agency Impersonation
Since late 2024, a Chinese cybercriminal network known as the “Smishing Triad” has executed one of the largest organized smishing campaigns ever documented, impersonating E-ZPass, SunPass, FasTrak, and state DMVs across at least eight states. More detail on this is in the section below.
4. MFA Bypass Attacks
Multi-factor authentication was supposed to stop credential theft. Attackers adapted. In a real-time relay attack, a criminal logs in to a target account using stolen credentials and simultaneously triggers an MFA code sent to the victim’s phone. A smishing message then asks the victim to “confirm” the code, and they enter it without realizing they’ve just handed over the final key. According to Proofpoint, at least 55% of suspected smishing messages contain malicious URLs, many designed for exactly this purpose.
5. “Call-Back” Smishing
Rather than a link, some messages contain only a phone number. The person who answers is a trained social engineer who references real details about your bank, a recent transaction, or your employer to build trust before requesting sensitive information. Because no link is involved, many people don’t recognize this format as a smishing attack at all.
6. Fake Job Offer and HR Texts
Texts impersonating HR departments, payroll providers, or recruiters are increasingly common, particularly targeting employees who’ve recently changed jobs or are listed on professional networking sites. Attackers use these messages to request direct deposit information, Social Security numbers, or benefit enrollment data.
How AI Is Making Smishing More Dangerous
For years, smishing was relatively easy to spot: awkward phrasing, generic lures, obvious typos. Generative AI has erased most of those tells.
Attackers now use AI tools to accomplish four things they couldn’t do effectively before:
- Personalize at scale. Public data, including LinkedIn profiles, company websites, and data breach databases, is fed into AI systems that generate customized messages referencing your employer, your role, your name, and even recent company news. A text reading “Hi [Name], this is [Company] payroll. We need you to verify your direct deposit account before Friday’s run” is far harder to dismiss than a generic lure.
- Remove linguistic red flags. AI-generated smishing messages are grammatically clean, contextually accurate, and tonally appropriate. The old advice of “look for bad grammar” no longer applies reliably.
- Automate RCS and iMessage delivery. RCS (Rich Communication Services) is replacing SMS as the standard protocol for Android messaging, and Chinese smishing operations have already integrated RCS into their delivery infrastructure. RCS messages can include sender branding, images, and interactive buttons, making fake bank or employer notifications significantly more convincing.
- Combine smishing with vishing. AI voice cloning tools can replicate a person’s voice from just three seconds of audio. Coordinated campaigns now use a smishing text to prime the victim, then follow up with a spoofed voice call from a “known” person, a manager or bank representative, to deliver the actual ask. Vishing surged 442% between the first and second half of 2024 (CrowdStrike, 2025).
Commercial anti-smishing tools blocked only 25-35% of threats in 2025. AI-powered detection solutions reached 96.2% rates, a gap that shows how far ahead attackers currently sit. (Keepnet, 2026)
Real-World Smishing: The Toll Scam Surge
Starting in late 2024, the FBI, FTC, and state cybersecurity agencies began issuing warnings about an unprecedented wave of smishing attacks impersonating U.S. toll collection agencies. By the end of 2024, the FBI’s Internet Crime Complaint Center had received 59,271 complaints tied specifically to toll-related smishing, and the FTC reported Americans lost $470 million to text scams that year overall, a fivefold increase from 2020.
The scam follows a consistent pattern. A text arrives claiming you have a small unpaid toll, often just $3 to $5, from E-ZPass, SunPass, FasTrak, or your state’s tolling authority. The message warns of escalating fines or license suspension if you don’t pay immediately, and the link leads to a convincing fake payment page that collects your name, address, and payment card information.
The operation behind these texts, tracked by researchers as the “Smishing Triad,” registered over 60,000 fraudulent domain names, many ending in “.xin,” and has been linked to phishing kits marketed under names like “Lighthouse” and “Darcula.” Sold on criminal forums and Telegram channels, these kits enable even low-skill attackers to run large-scale campaigns. Confirmed targets include residents of Washington, Florida, Pennsylvania, Virginia, Texas, Ohio, Illinois, and Kansas, among others.
This is not a fringe operation. It’s a professional criminal supply chain targeting everyday text messages to millions of Americans at once.
Key takeaway for employees and employers: Government agencies, toll operators, courts, and law enforcement do not collect payments via text message. If you receive one of these texts, do not click. Report it and delete it.
How to Recognize a Smishing Text
Run through these five questions before responding to any unexpected text:
1. Did I initiate this?
Legitimate authentication codes, delivery updates, and account alerts are triggered by something you did first, such as logging in, placing an order, or requesting a password reset. Any text that arrives without a preceding action on your part deserves skepticism.
2. Is there urgency or a threat?
Attackers manufacture pressure: “Your account will be closed,” “Final notice,” “Respond within 24 hours.” Legitimate organizations rarely communicate via text when immediate action is required. Official apps, secure portals, and verified phone calls are the standard channels for urgent account matters.
3. Does the link match the sender?
Before clicking, press and hold the link (don’t tap) to preview the destination URL. A message claiming to be from your bank that links to secure-update-bankofamerica.xin or any unrecognized domain is a smishing attempt. Even plausible-looking URLs can be spoofed, so when in doubt, go directly to the official website by typing it yourself.
4. Is it asking for information the sender should already have?
Your bank already has your account number. Employers already has your direct deposit details. Your delivery carrier already has your address. Any text requesting information the sender should already possess is a red flag worth taking seriously.
5. Does it ask you to reply to make a link clickable?
Some smishing campaigns instruct victims to reply with “YES” or “STOP” to activate a link. This bypasses Apple’s iMessage link-blocking feature. Never reply to unknown senders, not even to opt out.
How to Protect Yourself and Your Employees
For Individuals
- Never click links in unexpected texts. Go directly to the official website or app instead.
- Avoid replying to unknown senders. Even a one-word reply confirms your number is active and increases future targeting.
- Verify independently. If a text claims to be from your bank, call the number on the back of your card, not any number provided in the message.
- Enable spam text filtering. Both iOS and Android offer built-in filters, and most carriers provide free blocking tools as well.
- Use phishing-resistant MFA. Hardware security keys or authenticator apps that don’t rely on SMS codes are significantly harder to bypass than one-time codes sent by text.
- Report suspicious texts. Forward smishing messages to 7726 (SPAM), a free service most carriers support, and file a complaint at reportfraud.ftc.gov or ic3.gov.
For Employers and HR Teams
- Train employees on smishing specifically, not just email phishing. Most security awareness programs overlook SMS as an attack channel, and that gap is increasingly costly.
- Run smishing simulations. Behavioral training using realistic fake texts outperforms lectures. Employees who’ve been tested respond better when a real attempt arrives.
- Establish a verification protocol for financial requests. Any text requesting a wire transfer, direct deposit change, or payroll action should require verbal confirmation through a known phone number, no exceptions.
- Audit which employees have work credentials tied to personal phone numbers. MFA codes sent to personal devices are a bypass risk if that device is compromised through a smishing attack.
- Offer identity theft protection as an employee benefit. When smishing succeeds, and sometimes it does even against trained employees, recovery speed matters. Employees with access to live restoration advocates can contain damage significantly faster than those navigating the process alone.
How to Report a Smishing Attempt
Reporting helps authorities track campaigns, take down fraudulent domains, and warn others. Here’s where to go:
- Forward the text to 7726 (SPAM), supported by most major U.S. carriers and free to use.
- File a complaint with the FTC at reportfraud.ftc.gov
- Report to the FBI’s IC3 at ic3.gov, particularly important for toll scams and financial fraud.
- Notify your mobile carrier directly if you’re receiving repeated attacks from the same number or domain.
- If you clicked a link or shared information, visit IdentityTheft.gov for step-by-step recovery guidance.
Frequently Asked Questions About Smishing
What is the difference between smishing and phishing?
Phishing is a broad term for social engineering attacks that trick victims into revealing sensitive information. Smishing is specifically phishing delivered via SMS or text message. Both rely on manipulation and deception, but smishing exploits the higher trust and weaker defenses associated with text messaging. Email phishing has the advantage of volume; smishing has the advantage of immediacy and a personal feel. The two are increasingly combined in coordinated multi-channel attacks.
Can smishing attacks install malware on my phone?
Yes. Some smishing messages contain links leading to sites designed to download malicious apps or exploit browser vulnerabilities. On Android devices in particular, attackers may direct victims to install APK files, which are apps from outside the official app store, that grant full access to contacts, messages, and stored credentials. iOS devices are harder to compromise through malware downloads, but smishing remains effective as a credential-harvesting and social engineering tool regardless of device type.
Why are smishing attacks increasing so fast?
Several factors are converging at once. AI tools lower the cost and effort of creating personalized, convincing messages. Phishing kits sold on criminal forums enable low-skill attackers to run large-scale campaigns. RCS and iMessage deliver richer, more believable messages than traditional SMS. On top of that, most people still don’t recognize smishing as a category of threat. The explosive growth of mobile-first communication combined with the relative weakness of carrier spam filtering has created conditions that are nearly ideal for attackers.
How do attackers get my phone number?
Smishing campaigns draw from multiple sources: data breaches that exposed phone numbers (major breaches in 2024 and 2025 collectively exposed hundreds of millions of records), scraped social media profiles, purchased marketing lists, randomly generated number ranges targeted by automated dialers, and numbers leaked through third-party apps. Your number can end up in an attacker’s database without you having done anything wrong.
What should I do if I already clicked a smishing link?
Act immediately. If you entered credentials, change your passwords on the affected account and any account sharing the same password, enable MFA if it wasn’t already active, and alert your bank or employer depending on what information was involved. If you entered payment card data, contact your card issuer to freeze the card and dispute any fraudulent charges. In both cases, run a security scan on your device, monitor your accounts closely for the next 30 days, and file a report at IdentityTheft.gov. If a workplace account or work-related credentials were involved, notify your IT or security team right away because time matters for containing a potential breach.
Do smishing attacks target businesses specifically?
Yes, and with increasing sophistication. Business-targeted smishing includes payroll redirect fraud, W-2 and HR data theft, wire transfer authorization scams impersonating executives, and credential theft targeting employees with access to company systems. Verizon’s 2025 Data Breach Investigations Report found that 19% of breaches now involve smishing or vishing as an entry vector. Small businesses face particular exposure because they’re less likely to have formal verification protocols for financial and credential requests.
Is there software that protects against smishing?
Yes, though no tool provides complete protection. Mobile threat defense (MTD) solutions can detect malicious links before they load. Carrier-level filtering blocks many known smishing domains, and email and communication security platforms increasingly include SMS monitoring for enterprise deployments. Commercial solutions achieved 25-35% blocking rates in 2025, while AI-powered tools reached 96.2%, but that still means a meaningful percentage of attacks get through. Technology reduces risk; awareness and verification habits are what actually eliminate it.
by Brian Thompson | Apr 1, 2026 | Breach, Identity Theft
Last Updated: April 2026 | Reading time: ~12 minutes
In March 2026, a ransomware gang hit BridgePay Network Solutions, a payment processor serving local governments and small businesses across the U.S. Systems went down. Customers couldn’t process transactions. And BridgePay scrambled for weeks to restore infrastructure. That same month, identity protection company Aura confirmed that a single employee fell for a voice phishing call, exposing personal data for roughly 900,000 people. No malware. No exploit. Just a convincing phone call.
These aren’t outliers. They’re Tuesday.
Small and mid-sized businesses now account for 63% of all data breaches tracked since January 2025, according to Proton’s 2026 SMB Cybersecurity Report. The SonicWall 2026 Cyber Protect Report found that 88% of SMB breaches involved ransomware, more than double the rate at large enterprises. And for the first time, cyberattacks now rank as the #1 business concern for SMBs, surpassing inflation, recession fears, and hiring challenges (VikingCloud, 2026).
Yet only 26% of small businesses have a formal incident response plan. That gap between risk and readiness is where businesses get destroyed, not by the breach itself, but by the chaos that follows.
This small business post-breach playbook gives you a step-by-step framework for the critical first hours and days after a data breach. Whether you have two employees or two hundred, these are the actions that separate businesses that recover from those that don’t.
(more…)
by Brian Thompson | Mar 25, 2026 | Breach, Identity Theft, Scams
Phishing remains the most reported cybercrime in the United States. In 2024, the FBI’s Internet Crime Complaint Center (IC3) received 193,407 phishing complaints — more than double any other crime category — while total cybercrime losses hit a record $16.6 billion.
The old advice — “just look for typos and bad grammar” — no longer works. AI-generated phishing emails are now grammatically flawless, hyper-personalized, and nearly indistinguishable from legitimate messages. This guide covers what phishing looks like today, how attacks have evolved, and what your organization can do to build real phishing awareness and prevention.
What Is Phishing?
Phishing is a form of social engineering where attackers impersonate trusted entities — banks, coworkers, software providers, even government agencies — to trick people into revealing sensitive information or installing malware.
The attack typically arrives as an email, but increasingly comes through text messages (smishing), phone calls (vishing), and even QR codes (quishing).
What makes phishing so effective isn’t technical sophistication — it’s psychological manipulation. Attackers exploit urgency, fear, authority, and trust to get you to act before you think. A message that says “Your account will be suspended in 24 hours” isn’t trying to inform you. It’s trying to panic you into clicking.
Phishing by the Numbers: 2025–2026 Statistics
The following data comes from the FBI IC3 2024 Annual Report, Verizon’s 2025 Data Breach Investigations Report (DBIR), the Anti-Phishing Working Group (APWG), and IBM’s Cost of a Data Breach Report.
| Metric |
Figure |
Source |
| Phishing/spoofing complaints to FBI (2024) |
193,407 |
FBI IC3 2024 |
| Total U.S. cybercrime losses (2024) |
$16.6 billion (+33% YoY) |
FBI IC3 2024 |
| Business Email Compromise losses (2024) |
$2.77 billion |
FBI IC3 2024 |
| Average cost per phishing breach |
$4.88 million |
IBM 2025 |
| Breaches involving human action |
60% |
Verizon 2025 DBIR |
| Phishing attacks recorded (Q2 2025) |
1.13 million |
APWG |
| Ransomware present in breaches |
44% (up from 32%) |
Verizon 2025 DBIR |
| Employees susceptible to phishing (no training) |
33.1% |
KnowBe4 2025 |
| Phishing susceptibility reduction with training (1 year) |
Up to 86% |
KnowBe4 2025 |
Why Phishing Awareness and Prevention Matter More Than Ever
Technology alone cannot stop phishing. Spam filters, email gateways, and AI-based detection tools all help — but attackers design their campaigns specifically to bypass these defenses. The 2025 Verizon DBIR found that approximately 60% of all confirmed breaches involved a human action: a click, a download, a response to a spoofed email.
The data on training is compelling. KnowBe4’s 2025 benchmark report — based on 14.5 million users and 67.7 million simulated phishing tests — found that one-third of untrained employees will fall for a phishing simulation. But organizations running ongoing security awareness programs see susceptibility drop by up to 86% within a year.
Verizon’s data adds an important nuance: you can’t train people to never click. The median phishing simulation click rate holds steady at about 1.5% even with training. But recently trained employees report suspicious emails at a rate of 21%, compared to just 5% for those without recent training. That four-fold improvement in detection and reporting is where the real value lives.
Your people aren’t just the weakest link — with consistent training, they become a rapid-response detection network that catches what automated filters miss.
Types of Phishing Attacks to Watch For
Email phishing remains the most common vector. Bulk messages impersonate trusted brands to harvest credentials or deliver malware. In Q1 2025, Microsoft was impersonated in 36% of all brand phishing incidents worldwide, followed by Google (12%) and Apple (8%).
Spear phishing targets specific individuals with personalized messages. Attackers research their targets on LinkedIn, company websites, and social media to craft emails that reference real projects, colleagues, or events.
Business Email Compromise (BEC) is the most financially devastating variant. Attackers impersonate executives or vendors to authorize wire transfers or redirect payments. The FBI reported $2.77 billion in BEC losses in 2024, with nearly $8.5 billion lost over the 2022–2024 period alone. In 2025, 73% of BEC attacks originated from free webmail services.
Smishing and vishing use text messages and phone calls instead of email. CrowdStrike observed a 442% increase in vishing incidents between early and late 2024. These attacks exploit the trust people place in phone-based communication and the fact that mobile screens hide full URLs. For a deeper look, read our guide on how smishing attacks work and how to prevent them.
Quishing (QR code phishing) embeds malicious links in QR codes placed in emails, flyers, or physical locations. Because the link is encoded in an image rather than text, it bypasses many traditional email security filters. QR code phishing attacks surged an estimated 400% between 2023 and 2025, with energy, healthcare, and manufacturing sectors hit hardest.
Clone phishing takes a legitimate email you’ve already received, copies it, and replaces a link or attachment with a malicious version. Because the message looks identical to something real, it’s especially hard to detect.
MFA bypass attacks use adversary-in-the-middle (AiTM) techniques to intercept session cookies in real time, effectively neutralizing multi-factor authentication. AiTM attacks targeting MFA surged 146% in 2024.
How to Spot a Phishing Email: A Checklist
Use this checklist before acting on any suspicious message:
1. Check the sender’s actual email address. Display names are easily spoofed. Click or hover to reveal the full address. Watch for slight misspellings like support@arnazon.com instead of support@amazon.com.
2. Look for urgency or threats. Messages demanding immediate action — “Your account will be locked,” “Payment overdue,” “Respond within 24 hours” — are using fear to override your judgment. Legitimate organizations rarely communicate this way.
3. Hover over links before clicking. On desktop, preview the destination URL before clicking. If the URL doesn’t match the organization the email claims to be from, don’t click. Be especially cautious with shortened URLs (bit.ly, tinyurl) that hide the true destination.
4. Question unexpected attachments. PDF and Word attachments that arrive without context are a common malware delivery method. If you weren’t expecting a file, verify with the sender through a separate channel before opening it.
5. Watch for generic greetings in “personal” messages. An email from your bank that says “Dear Customer” instead of your name may be a mass phishing campaign. However, be aware that AI-powered phishing can now personalize greetings — a correct name alone doesn’t guarantee legitimacy.
6. Be skeptical of QR codes in unexpected places. Whether it’s in an email, on a parking meter sticker, or on a restaurant table card — check the URL a QR code loads before entering any information.
7. Watch for mismatched tone or context. An email from your CEO asking you to buy gift cards. A vendor suddenly changing their payment details. A coworker sending a link with no explanation. When something feels off, trust that instinct and verify.
Phishing Prevention Best Practices for Organizations
Run regular phishing simulations. Don’t train once a year and call it done. Conduct quarterly or monthly simulated phishing campaigns that mirror real-world attack patterns. Track click rates and reporting rates. The goal isn’t zero clicks — it’s faster detection and reporting.
Deploy multi-factor authentication — and understand its limits. MFA significantly reduces credential theft risk. But AiTM proxy attacks can bypass traditional MFA methods like SMS codes and push notifications. Where possible, adopt phishing-resistant MFA like FIDO2 hardware keys or passkeys, which are immune to session hijacking.
Implement email authentication protocols. Configure SPF, DKIM, and DMARC on your organization’s domains. CISA specifically recommends these protocols to prevent email spoofing. They won’t stop all phishing, but they make it significantly harder for attackers to impersonate your domain.
Verify through a separate channel. If an email requests a wire transfer, password reset, or sensitive data — even if it appears to come from your CEO — pick up the phone and confirm using a known number. Never use contact information provided in the suspicious email itself.
Build a reporting culture. Don’t just tell employees to delete suspicious emails — give them a simple way to report them. Forward phishing attempts to your IT or security team so they can block the sender, alert the organization, and improve filtering. Verizon’s 2025 data shows that building a reporting culture delivers more security value than trying to eliminate all clicks.
Keep software and systems updated. Phishing often delivers malware that exploits known vulnerabilities. Timely patching closes these doors. The 2025 Verizon DBIR found that vulnerability exploitation now accounts for 20% of all breaches, and for edge devices like VPNs, attackers often exploit flaws on the same day they’re published.
Protect your business data with layered defenses. No single tool stops phishing on its own. Combine email filtering, endpoint detection, DNS-level blocking, MFA, and employee training into a defense-in-depth strategy.
AI-Powered Phishing: What’s Changed
Generative AI has fundamentally shifted the phishing landscape. Attackers no longer rely on volume alone — they can now produce polished, context-aware, multilingual messages in minutes. IBM estimates that a convincing phishing email can be generated in about five minutes using AI tools, compared to roughly sixteen hours for a human team.
The data reflects this shift. Over 82% of phishing emails detected between September 2024 and February 2025 showed indicators of AI assistance. During the 2025 holiday season, Hoxhunt’s threat detection network observed AI-generated phishing jump from about 4% of detected phishing emails in November to 56% in December — a 14x surge.
AI is also powering deepfake scams: cloned executive voices used in fraudulent phone calls that blend vishing with BEC. These attacks are still relatively rare, but growing.
For a deeper look at how generative AI has changed attack methods and what your organization can do about it, read our full guide: AI-Powered Phishing Attacks: How Generative AI Is Changing Scams.
Frequently Asked Questions About Phishing
What is the most common type of phishing attack?
Email phishing remains the most widespread method. The FBI received 193,407 phishing and spoofing complaints in 2024 — more than any other cybercrime category. However, attacks via text message (smishing) and phone calls (vishing) are growing rapidly.
How much does a phishing attack cost a business?
The average cost of a phishing-related data breach is $4.88 million, according to IBM’s 2025 Cost of a Data Breach Report. Business Email Compromise attacks alone caused $2.77 billion in losses in the U.S. in 2024.
Does security awareness training actually reduce phishing risk?
Yes. KnowBe4’s 2025 report found that one-third of untrained employees fall for simulated phishing, but organizations with ongoing training reduce susceptibility by up to 86% within a year. Verizon’s data shows trained employees are four times more likely to report suspicious emails.
Can phishing bypass multi-factor authentication (MFA)?
Yes. Adversary-in-the-middle (AiTM) attacks can intercept session cookies and bypass traditional MFA methods like SMS codes or push notifications. Phishing-resistant MFA — such as FIDO2 hardware keys or passkeys — is the most effective defense against these attacks.
What should I do if I clicked a phishing link?
Disconnect from the network immediately. Change your passwords from a known-safe device. Enable or reset MFA on affected accounts. Report the incident to your IT or security team. Monitor your accounts and consider enrolling in an identity theft protection service.
What is quishing?
Quishing is phishing delivered via QR codes. Attackers place malicious QR codes in emails, physical flyers, or even on top of legitimate QR codes in public places. Scanning the code takes you to a credential-harvesting or malware-delivery site. These attacks surged an estimated 400% between 2023 and 2025.
Last updated: March 2026
Related reading from Defend-ID:
