What happened
- Verizon's 2025 DBIR press release (Apr 23, 2025) reports 12,195 confirmed breaches analysed.
- Credential abuse was the top initial vector at 22%, and exploitation was 20%.
- Third-party involvement doubled to 30%.
- Ransomware appeared in 44% of breaches, in 88% of SMB breaches versus 39% across all organizations. The median ransom was $115,000.
- The 2026 edition (incident window Nov 1, 2024 to Oct 31, 2025) states: "31% of breaches now start with software vulnerabilities".
- Secondary source: the Cyber Readiness Institute summary of the 2026 edition (June 1, 2026) reports small-organization figures: 96% of ransomware victims, 38% compromised credentials and 29% unpatched edge devices.
The 88% and 96% figures measure different things and should not be compared. The Cyber Readiness Institute figures are from a secondary source, and we do not state how "small" is defined there.
Root cause, per the sources
These are statistics, not a single incident. The sources name credential abuse and exploitation of vulnerabilities as leading initial vectors.
The exposure behind it
Compromised credentials and unpatched internet-facing systems appear as leading starting points in the sources. Some of the conditions around them, such as exposed files and missing MFA, can be checked from outside or through a connector.
What PixelPrivate can check
External scan
Checks public hosts for exposed files, certificate and header problems, and a short list of admin-panel paths.
Learn moreMicrosoft 365 connector (new)New
Shows MFA registration coverage and legacy authentication settings.
Learn moreWhat PixelPrivate cannot do
- PixelPrivate does not detect intrusions, fraud or active attacks. It performs passive external checks and reports exposures.
- We cannot see whether your edge devices are patched beyond what is visible from outside, and we cannot prevent ransomware.
- We cannot claim that PixelPrivate would have prevented this incident, and we do not claim that.
What to do this week
- Turn on MFA for email and administrator accounts.
- List internet-facing devices and check each has current updates.
- Check that backups exist and that a restore has been tested.
- Ask your vendors about their own security practices.
Sources
- Verizon, “2025 Data Breach Investigations Report (press release)”, Apr 23, 2025. https://www.verizon.com/about/news/2025-data-breach-investigations-report
- Verizon, “Data Breach Investigations Report (2026 edition)”, 2026. https://www.verizon.com/business/resources/reports/dbir/
- Cyber Readiness Institute (secondary source), “Verizon DBIR 2026: small businesses face escalating cyber threats”, June 1, 2026. https://cyberreadinessinstitute.org/news-and-events/verizon-dbir-2026-small-businesses-face-escalating-cyber-threats/(secondary source)
Last reviewed 2026-10-06. Figures are quoted as reported by the cited source.
Related hypothetical scenarios
Questions about this incident
Can I compare 88% and 96%?
No. They measure different things and come from different sources.
What was the median ransom?
The 2025 DBIR press release reports a median ransom of $115,000.
What was the top initial vector?
Credential abuse at 22%, with exploitation at 20%, in the 2025 edition.
