From Past to Present: The Evolution of Data Breach Causes (2005–2025)

This review aims to analyze the changing causes of data breaches over two decades by synthesising evidence from various data breach investigation reports and regulatory filings. The methodology involves examining trends in threat actors, actions, and motives identified in reports such as the Verizon Data Breach Investigations Report (DBIR) series from 2008 to 2024, California Attorney General's reports, and the Privacy Rights Clearinghouse. (1,2,3) The findings reveal an evolution through distinct phases: an initial period (roughly 2008-2010) dominated by external breaches leveraging hacking and malware, a subsequent era (2011-2019) marked by the rise of sophisticated cybercrime, including increased phishing and the emergence of defined incident patterns, and a more recent epoch (2020-2024) characterised by a significant surge in ransomware attacks, exploitation of systemic vulnerabilities, and the convergence of financially motivated and nation-state actors. Throughout these periods, human factors and errors have consistently contributed to successful breaches. In conclusion, the landscape of data breaches have shifted from simpler external attacks to more complex and disruptive campaigns, where human vulnerabilities remain a key enabler, and the emerging landscape includes AI-driven threats that are being explored by both attackers and defenders, necessitating continuous adaptation of defence strategies to address both traditional weaknesses and novel AI-related risks.