ForgeRock Consumer Identity Breach Report

Executive Summary

In 2019, Gartner estimated worldwide spending on information security-related products and services would be $124 billion1 – increasing 8% from 2018. And the number of consumers and organizations impacted by breaches and malicious attacks continues to grow. For the second year of this report, personally identifiable information (PII) was the most targeted data type in 2019, accounting for 98% of data – further highlighting the appeal of personal data to malicious actors.

Since the 2019 “ForgeRock Consumer Breach Report” was released with data from 2018, the average cost of a breach in the U.S. increased 112% to $8.19 million in 20192, up from $3.86 million. Also increasing in 2019 was the number of consumer records impacted – over five billion consumer records, up 78.57% from the 2.8 billion impacted in 2018.

As organizations recover from effects of the COVID-19 pandemic, the impact of these breaches extends beyond the bottom line. Consumers are leveraging their digital identity more than ever for tasks and online activities to maintain their daily lives, for everything from remote access to work applications to ordering groceries or takeout delivery. Protecting digital identities is no longer an afterthought for organizations; it is an immediate mandate to maintain trust with consumers and avoid costly breaches.

This report shares detailed insights and data on the breaches impacting consumers in 2019 and Q1 2020, as well as providing year-over-year comparisons to breaches affecting consumers in 2018 in the U.S. It also includes findings from other key regions including Australia, Germany, and the United Kingdom.

Some key U.S. findings in this year’s report include:

• PII continues to be the number one data target for malicious actors, 98%.
• For the second year in a row, unauthorized access is the number one attack method by cybercriminals, 40%.
• Social Security numbers and date of birth records were the most targeted data, 37%.

In this report, the findings and trajectory for future data breaches expose the need for organizations to adopt a comprehensive identity and access management (IAM) solution, not only to avoid the associated costs of a breach, but also to protect consumer data and relationships.