Incident Response trends Q2 2023: Data theft extortion rises, while healthcare is still most-targeted vertical
Summary: Cisco Talos Incident Response reported that data theft extortion was the most-observed threat in Q2 2023, accounting for 30 percent of engagements and a 25 percent increase in incidents over the prior quarter, with actors stealing data and threatening to leak or sell it without deploying ransomware or encrypting files. Compromised credentials or valid accounts were the top initial access vector at nearly 40 percent of engagements, healthcare remained the most-targeted vertical at 22 percent, and ransomware accounted for 17 percent of engagements, up from 10 percent last quarter.
What you should know: In nearly 40 percent of engagements attackers used valid accounts, and 90 percent of those accounts did not have MFA enabled - a lack of MFA or improper implementation factored into over 40 percent of the incidents Talos IR handled.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026