System intrusions cause 80% of Asia-Pacific data breaches

The 2025 Data Breach Investigations Report (DBIR) from Verizon has found that system intrusions were responsible for 80% of data breaches in the Asia-Pacific region over the past year.

The report, now in its eighteenth year, is based on the analysis of more than 22,000 security incidents, including 12,195 confirmed breaches across 139 countries and multiple industry sectors. Included among its key findings is a marked increase in system intrusions in the Asia-Pacific region, jumping from 38% of breaches last year to 80% this year. This trend, according to Verizon, reflects shifting tactics by cyber attackers targeting regional organisations.

In the Asia-Pacific region, the use of malware in breaches increased from 58% to 83% over the past year, with email remaining the primary method for distributing malware. Ransomware accounted for 51% of violations in the region. More than half of the victim organisations had credentials exposed on the dark web during the period covered by the report.

"This year's report reinforces the growing complexity and persistence of cyber threats facing organisations worldwide. In the Asia-Pacific region in particular, external actors are targeting critical infrastructure and exploiting third-party vulnerabilities. The rising incidence of breaches highlights the imperative for businesses to reassess their risk frameworks," Robert Le Busque, Regional Vice President, Asia Pacific for Verizon Business, said.

Social engineering incidents showed a relative decline in the Asia-Pacific region, accounting for 20% of breaches in 2025, which was attributed to a significant increase in system intrusion-related incidents. Credential exposure and malware-laden phishing emails continue to be persistent threats to businesses throughout the region.

Globally, the report identified an increase in the exploitation of vulnerabilities as an initial attack vector, with a 34% rise compared to last year. Zero-day exploits, particularly those targeting perimeter devices and VPNs, were highlighted as a driving force behind breach volumes. Third-party and supply chain risks saw a doubling in the portion of breaches involving external partners, underscoring the growing interconnectedness and associated risk in global business ecosystems.

Ransomware was found in 44% of breaches worldwide, representing a 37% increase from the previous year. However, the median ransom payment fell to $115,000. Human involvement continues to play a significant role in breaches, with social engineering and credential abuse remaining frequent attack methods.

The report also points to an increase in espionage-motivated attacks in the Manufacturing and Healthcare industries. Persistent threats remain a concern for sectors such as education, Financial Services, and Retail. Small and medium-sized businesses (SMBs) were identified as disproportionately impacted by ransomware, frequently being less resourced to manage the fallout of a cyber attack.

"This year's DBIR findings reflect a mixed bag of results. Glass-half-full types can celebrate the rise in the number of victim organizations that did not pay ransoms with 64% not paying vs 50% two years ago. The glass-half empty personas will see in the DBIR that organizations that don't have the proper IT and cybersecurity maturity – often the SMB sized organizations, are paying the price for their size with ransomware being present in 88% of breaches. While there is no magic pill to swallow that will alleviate the pain of cybersecurity attacks, Verizon's leadership in educating the public on the types of attacker motives, tactics and techniques is a key head start in raising global awareness and cyber readiness," Craig Robinson, Research Vice President, Security Services at IDC, commented on the findings.

The 2025 edition of the DBIR highlights the ongoing evolution of cybercriminal tactics, with increased targeting of critical infrastructure, widespread use of ransomware, and expanding risks associated with third-party suppliers. The findings indicate that organisations worldwide, particularly those in Asia-Pacific and SMB segments, continue to face a challenging threat landscape characterised by rising intrusion and malware rates.

The report urges organisations to re-examine their cyber risk frameworks and take proactive steps to strengthen their security posture in the face of persistent and complex cyber threats.