Introduction to Regions

This edition of the DBIR marks the third year that we have analyzed incidents and presented them from a macro-region perspective. It is our hope that our readers find this more global view of cybercrime helpful and informative. As we have mentioned in the past, we have greater or lesser visibility into a given region based on numerous factors such as contributor presence, regional disclosure regulations, our own caseload and so on.

If you reside and work in a part of the world that is not mentioned in the following pages, please contact us about becoming a data contributor and encourage other organizations in your area to do the same, so that we may continue to expand and refine our coverage each year. It is important to keep in mind that if you do not see your region represented here it does not necessarily mean that we have no visibility at all into the region, but simply that we do not have enough incidents in that geographic location to be statistically relevant for a stand-alone section.

We define the regions of the world in accordance with the United Nations M49 standards, which combines the super-region and sub-region of a country together. By so doing, the regions we will examine are as follows:

APAC: Asia and the Pacific, including Southern Asia (034), South-eastern Asia (143), Central Asia (143), Eastern Asia (030) and Oceania (009)

EMEA: Europe, Middle East and Africa, including North Africa (002), Europe and Northern Asia (150) and Western Asia (145)

NA: Northern America (021), which primarily consists of breaches in the United States and Canada

LATAM: Latin America and Caribbean, which consists of breaches in South America (005), Central America (013) and Caribbean (029)

Since our dataset shows a strong Northern American (NA) bias, we find that as this region goes, so goes the dataset. This is nowhere more evident than when looking at the top three patterns for Northern America. These three mirrors the top patterns for the full dataset. The bias is due to a combination of things. First of all, the breach disclosure laws in NA are quite robust, and they continue to evolve. Determining all the places you must report a breach to in Northern America almost requires a decoder ring and Magic 8 Ball. In addition to this, most of our data sharing contributors have excellent visibility into the NA region, in both private and public sectors. And, frankly, our English is excellent, our French and Portuguese passable, but beyond that our linguistic facilities falter. All of this means we have very good data on this region–more so than any other.

We can see in Figure 109, that while the Social Engineering pattern has held sway for some time as the top pattern in breaches, last year showed a change. The top pattern is now System Intrusion, which is also where most of the Ransomware cases reside. It is surely no secret that Ransomware has been rising for several years and has become quite prominent in our data. 

In fact, for cases where malware is present, Ransomware is by far the most common variety (Figure 110). Increasingly over the past several years, this attack has the one-two punch of causing both a loss of access to the data, and the need to report a data breach as the actors have also taken a copy of the organization’s data. 

Water might spin in the opposite direction in the Southern Hemisphere, but breaches and incidents seem to go down just as they do elsewhere. Unfortunately, our data collection for this section of the world is still very sparse, and we’re still in need of partners to help us round out our understanding of what’s going on with our friends in the South. If your organization operates in this region please reach out and join us. 

Figure 113 provides a breakdown of what industries have been breached in Latin America. While we don’t necessarily have a large number of breaches, we certainly have a diverse collection of compromised organizations, with over 40% of victims not from the top six.

Just like their Northern American counterparts, Latin American industries face the looming threat of ransomware. This attack type accounts for over 30% of their incidents. This is followed by the ever-present DoS attack. This region of the world also experiences its fair share of Phishing attacks and Stolen credentials, which we realize may be beginning to sound like a broken record. Or erg… would a buffering looping advert be the modern equivalent? At this point we’re beginning to get the feeling that some of these attacks are universal to anyone who has some form of internet presence.