Every year, the IBM Security X-Force team of cybersecurity experts mines billions of data points to reveal today’s most urgent security statistics and trends. This year’s X-Force Threat Intelligence Index 2022 digs into attack types, infection vectors, top threat actors, malware trends and industry-specific insights.

This year, a new industry took the infamous top spot: manufacturing. For the first time in over five years, finance and insurance were not the top-attacked industries in 2021, as manufacturing overtook them by a slight margin. Here’s a breakdown of the top five industries targeted and what businesses need to know about each one.

#1 Manufacturing

For the first time since 2016, manufacturing was the most attacked industry in 2021, targeted in 23.2% of the attacks addressed by X-Force.

Accounting for 23% of attacks, ransomware was the top attack type, exposing the heavy focus ransomware actors place on manufacturing. Server access attacks came in second place at 12%, which might represent some failed attack operations. Business email compromise (BEC) and data theft tied for third place, at 10% each.

BEC attacks often seek to take advantage of manufacturer relationships with suppliers, sub-suppliers and wholesale shipping. Threat actors redirect payments between partners to accounts under the BEC attackers’ control. Meanwhile, data theft efforts may focus on stealing sensitive intellectual property or holding data for ransom.

#2 Finance and insurance

Attackers hit finance and insurance companies in 22.4% of attacks remediated by X-Force in 2021. Compared to prior years, the financial industry’s attack rate has fallen. This suggests that financial companies are putting higher standards in place. In addition, financial services use hybrid cloud environments, which enable improved data visibility and management.

Server access breaches (14%) were found to be the top attack type on finance and insurance companies. This was followed by ransomware, misconfigurations and fraud, all coming in at 10%. Meanwhile, phishing was the most common infection vector for financial services, leading to 46% of attacks against this sector in 2021.

#3 Professional and business services

Professional services include IT providers, law firms, architects, accountants and consultants. Business services include office administration, HR, security services, travel assistance and landscaping. Professional and business services firms accounted for 12.7% of all attacks observed in 2021.

Ransomware was the top attack type for this sector, making up 32% of all attacks observed by X-Force. Server access attacks were the second-most common attack type (19%). A decrease in ransomware attacks in Q4 suggests that professional services firms are doing a better job at thwarting ransomware attacks. Vulnerability exploitation accounted for 50% of incidents, and phishing accounted for another 20% in this sector.

#4 Energy

The energy industry was the fourth most attacked in 2021, with 8.2% of all attacks observed. The X-Force report speculates that threat actors shifted their focus away from energy entities for a brief time in fear of retaliation for the ransomware attack on the Colonial Pipeline in May 2021. But attack rates appear to be rising since September.

Ransomware (25%) was the most common attack type against energy organizations in 2021. This was followed by remote access trojans (RATs), direct denial of service and BEC, all of which tied for second place (17%). Phishing was the most common attack vector, making up around 60% of attacks against the energy sector. Vulnerability exploitation made up the other 40% of incidents.

#5 Retail and wholesale

Retail and wholesale were the fifth most targeted in X-Force’s 2022 ranking. Overall, the sector faced 7.3% of all attacks. Within the sector, retail accounted for 35% and wholesale 65% of attacks. Threat actors may have focused more on wholesale groups due to their role in supply chains.

BEC, server access, data theft and credential harvesting were the top attack types on retail and wholesale last year. Ransomware and banking trojans also accounted for a large number of attacks, followed by RATs, misconfiguration and fraud. Phishing was the top infection vector for the sector, accounting for 38% of the attacks. Stolen credentials were the second most common vector at 31%. Meanwhile, vulnerability exploitation made up another 23% and brute force 8%.

Adapt and thrive

The threat landscape is constantly changing, and each industry has its unique challenges. Overall, ransomware continues to be the top threat in most sectors. As shown by the improvement in finance and insurance, efforts to strengthen digital defenses lead to concrete results against established and emerging threats.

More from Risk Management

Are we getting better at quantifying risk management?

4 min read - As cyber threats grow more sophisticated and pervasive, the need for effective risk management has never been greater. The challenge lies not only in defining risk mitigation strategy but also in quantifying risk in ways that resonate with business leaders. The ability to translate complex technical risks into understandable and actionable business terms has become a crucial component of securing the necessary resources for cybersecurity programs.What approach do companies use today for cyber risk quantification? And how has cyber risk…

Cybersecurity Awareness Month: Cybersecurity awareness for developers

3 min read - It's the 21st annual Cybersecurity Awareness Month, and we’re covering many different angles to help organizations manage their cybersecurity challenges. In this mini-series of articles, we’re focusing on specific job roles outside of cybersecurity and how their teams approach security.For developers, cybersecurity has historically been a love-hate issue. The common school of thought is that coders are frustrated with having to tailor their work to fit within cybersecurity rules. However, many companies are embracing a security-first approach, and some developers…

Spooky action: Phantom domains create hijackable hyperlinks

4 min read - According to a recent paper published at the 2024 Web Conference, so-called "phantom domains" make it possible for malicious actors to hijack hyperlinks and exploit users' trust in familiar websites.The research defines phantom domains as active links to dot-com domains that have never been registered.Here's what enterprises need to know about how phantom domains emerge, the potential risks they represent and what they can do to disrupt phantom attacks. There are two common types of phantom domains: Errors and placeholders.Domain errorsErrors…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today