Phishing, ransomware, and business malware have been the most widespread types of cyberattacks in the United States, resulting in data compromises. In 2024, 455 cases of phishing and its variations were detected. Ransomware followed in the second place, with 188 attacks.

📂

The Global Cybersecurity Threats Dataset (2015-2024) provides extensive data on cyberattacks, malware types, targeted industries, and affected countries. It is designed for threat intelligence analysis, cybersecurity trend forecasting, and machine learning model development to enhance global digital security.

📊 Column Descriptions

The largest reported data leakage as of January 2025 was the Cam4 data breach in March 2020, which exposed more than 10 billion data records. The second-largest data breach in history so far, the Yahoo data breach, occurred in 2013. The company initially reported about one billion exposed data records, but after an investigation, the company updated the number, revealing that three billion accounts were affected. The National Public Data Breach was announced in August 2024. The incident became public when personally identifiable information of individuals became available for sale on the dark web. Overall, the security professionals estimate the leakage of nearly three billion personal records. The next significant data leakage was the March 2018 security breach of India's national ID database, Aadhaar, with over 1.1 billion records exposed. This included biometric information such as identification numbers and fingerprint scans, which could be used to open bank accounts and receive financial aid, among other government services.

Cybercrime - the dark side of digitalization As the world continues its journey into the digital age, corporations and governments across the globe have been increasing their reliance on technology to collect, analyze and store personal data. This, in turn, has led to a rise in the number of cyber crimes, ranging from minor breaches to global-scale attacks impacting billions of users – such as in the case of Yahoo. Within the U.S. alone, 1802 cases of data compromise were reported in 2022. This was a marked increase from the 447 cases reported a decade prior. The high price of data protection As of 2022, the average cost of a single data breach across all industries worldwide stood at around 4.35 million U.S. dollars. This was found to be most costly in the healthcare sector, with each leak reported to have cost the affected party a hefty 10.1 million U.S. dollars. The financial segment followed closely behind. Here, each breach resulted in a loss of approximately 6 million U.S. dollars - 1.5 million more than the global average.

Business Context: We are in a time where businesses are more digitally advanced than ever, and as technology improves, organizations’ security postures must be enhanced as well. Failure to do so could result in a costly data breach, as we’ve seen happen with many businesses. The cybercrime landscape has evolved, and threat actors are going after any type of organization, so in order to protect your business’s data, money and reputation, it is critical that you invest in an advanced security system. Cyber security can be described as the collective methods, technologies, and processes to help protect the confidentiality, integrity, and availability of computer systems, networks and data, against cyber-attacks or unauthorized access. a. Information Security vs. Cyber Security vs. Network Security: Information security (also known as InfoSec) ensures that both physical and digital data is protected from unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction. Information security differs from cyber security in that InfoSec aims to keep data in any form secure, whereas cyber security protects only digital data. Cyber security, a subset of information security, is the practice of defending your organization’s networks, computers and data from unauthorized digital access, attack or damage by implementing various processes, technologies and practices. With the countless sophisticated threat actors targeting all types of organizations, it is critical that your IT infrastructure is secured at all times to prevent a full-scale attack on your network and risk exposing your company’ data and reputation. Network security, a subset of cyber security, aims to protect any data that is being sent through devices in your network to ensure that the information is not changed or intercepted. The role of network security is to protect the organization’s IT infrastructure from all types of cyber threats including: Viruses, worms and Trojan horses a. Zero-day attacks b. Hacker attacks c. Denial of service attacks d. Spyware and adware Your network security team implements the hardware and software necessary to guard your security architecture. With the proper network security in place, your system can detect emerging threats before they infiltrate your network and compromise your data. There are many components to a network security system that work together to improve your security posture. The most common network security components include: a. Firewalls b. Anti-virus software c. Intrusion detection and prevention systems (IDS/IPS) d. Virtual private networks (VPN) Network Intrusions vs. Computer intrusions vs. Cyber Attacks 1. Computer Intrusions: Computer intrusions occur when someone tries to gain access to any part of your computer system. Computer intruders or hackers typically use automated computer programs when they try to compromise a computer’s security. There are several ways an intruder can try to gain access to your computer. They can Access your a. Computer to view, change, or delete information on your computer, b. Crash or slow down your computer c. Access your private data by examining the files on your system d. Use your computer to access other computers on the Internet. 2. Network Intrusions: A network intrusion refers to any unauthorized activity on a digital network. Network intrusions often involve stealing valuable network resources and almost always jeopardize the security of networks and/or their data. In order to proactively detect and respond to network intrusions, organizations and their cyber security teams need to have a thorough understanding of how network intrusions work and implement network intrusion, detection, and response systems that are designed with attack techniques and cover-up methods in mind. Network Intrusion Attack Techniques: Given the amount of normal activity constantly taking place on digital networks, it can be very difficult to pinpoint anomalies that could indicate a network intrusion has occurred. Below are some of the most common network intrusion attack techniques that organizations should continually look for: Living Off the Land: Attackers increasingly use existing tools and processes and stolen credentials when compromising networks. These tools like operating system utilities, business productivity software and scripting languages are clearly not malware and have very legitimate usage as well. In fact, in most cases, the vast majority of the usage is business justified, allowing an attacker to blend in. Multi-Routing: If a network allows for asymmetric routing, attackers will often leverage multiple routes to access the targeted device or network. This allows them to avoid being detected by having a large portion of suspicious packets bypass certain network segments and any relevant network intrusion systems. Buffer Overwrit...

Multiple Datasets related to 2023 data, and some past data from previous years to show trends overtime in Cybersecurity complaints and losses. Including 2009-2023 MGM Resorts International Net Income and 2023 Cyberattack Filing Report.

In 2024, manufacturing saw the highest share of cyberattacks among the leading industries worldwide. During the examined year, manufacturing companies encountered more than a quarter of the total cyberattacks. Organizations in the finance and insurance followed, with around 23 percent. Professional, business, and consumer services ranked third, with 18 percent of reported cyberattacks. Manufacturing industry and cyberattacks The industry of manufacturing has been in the center of cyberattacks in a long time. The share of cyberattacks targeting organizations in this sector in 2018 was at 10 percent, while in 2024, it amounted to 26 percent. The situation is even more compliacted when we look at the cyber vulnerabilities found in this sector. In 2024, critical vulnerabilities in manufacturing companies lasted 205 days on average. IT perspective and prevention With recent technology developments, cybersecurity is crucial to an organization’s success. Realizing this, companies have been gradually increasing cybersecurity investments. Thus, in 2024, the cybersecurity budget worldwide was forecast to increase to nearly 283 billion U.S. dollars. Roughly nine in ten board directors of companies worldwide in professional services and media and entertainment industries say they expect an increase in the cybersecurity budget.

Microsoft is challenging the data science community to develop techniques for predicting the next significant cybersecurity incident. GUIDE, the largest publicly available collection of real-world cybersecurity incidents, enables researchers and practitioners to experiment with authentic cybersecurity data to advance the state of cybersecurity. This groundbreaking dataset contains over 13 million pieces of evidence across 33 entity types, covering 1.6 million alerts and 1 million annotated incidents with triage labels from customers over a two-week period. Of these incidents, 26,000 contain additional remediation action labels from customers. The dataset includes telemetry from over 6,100 organizations, featuring 9,100 unique custom and built-in DetectorIds across numerous security products, encompassing 441 MITRE ATT&CK techniques. GUIDE offers a first of its kind opportunity to develop and benchmark next-generation machine learning models on comprehensive guided response telemetry, supporting efforts to tackle one of cybersecurity's most challenging problems.

For additional information on GUIDE and Microsoft's approach to Guided Response in Copilot for Security, see the arXiv paper here.

Introduction

In the rapidly evolving cybersecurity landscape, the sharp rise in threat actors has overwhelmed enterprise security operation centers (SOCs) with an unprecedented volume of incidents to triage. This surge requires solutions that can either partially or fully automate the remediation process. Fully automated systems demand an exceptionally high confidence threshold to ensure correct actions are taken 99% of the time to avoid inadvertently disabling critical enterprise assets. Consequently, attaining such a high level of confidence often renders full automation impractical.

This challenge has catalyzed the development of guided response (GR) systems to support SOC analysts by facilitating informed decision-making. Extended Detection and Response (XDR) products are ideally positioned to deliver precise, context-rich guided response recommendations thanks to their comprehensive visibility across the entire enterprise security landscape. By consolidating telemetry across endpoints, network devices, cloud environments, email systems, and more, XDR systems can harness a wide array of data to provide historical context, generate detailed insights into the nature of threats, and recommend tailored remediation actions.

Dataset Overview

We provide three hierarchies of data: (1) evidence, (2) alert, and (3) incident. At the bottom level, evidence supports an alert. For example, an alert may be associated with multiple pieces of evidence such as an IP address, email, and user details, each containing specific supporting metadata. Above that, we have alerts that consolidate multiple pieces of evidence to signify a potential security incident. These alerts provide a broader context by aggregating related evidences to present a more comprehensive picture of the potential threat. At the highest level, incidents encompass one or more alerts, representing a cohesive narrative of a security breach or threat scenario.

Benchmarking

With the release of GUIDE, we aim to establish a standardized benchmark for guided response systems using real-world data. The primary objective of the dataset is to accurately predict incident triage grades—true positive (TP), benign positive (BP), and false positive (FP)—based on historical customer responses. To support this, we provide a training dataset containing 45 features, labels, and unique identifiers across 1M triage-annotated incidents. We divide the dataset into a train set containing 70% of the data and a test set with 30%, stratified based on triage grade ground-truth, OrgId, and DetectorId. We ensure that incidents are stratified together within the train and test sets to ensure the relevance of evidence and alert rows.

A secondary objective of GUIDE is to benchmark the remediation capabilities of guided response systems. To this end, we release 26k ground-truth labels for predicting remediation actions for alerts, available at both granular and aggregate levels. The recommended metric for evaluating research using the GUIDE dataset is macro-F1 score, along with details on precision and recall.

Privacy

To ensure privacy, we implement a stringent anonymization process. Initially, sensitive values are pseudo-anonymized using SHA1 hashing techniques. This step ensures that unique identifiers are obfuscated while maintaining their uniqueness for consistency across the dataset. Following this, we replace these hashed values with randomly generated IDs to further enhance anonymity and prevent any potential re-identification. Additionally, we introduce noise to the timestamps, ensuring that t...

The Dataset "Cyber Security Indexes" includes four indicators which illustrate the current cyber security situation around the world. The data is provided on 193 countries and territories, grouped by five geographical regions - Africa, North America, South America, Europe and Asia-Pasific.

The Cybersecurity Exposure Index (CEI) defines the level of exposure to cybercrime by country from 0 to 1; the higher the score, the higher the exposure (provided by 10guard). The indicator was last updated in 2020.

The Global Cyber Security Index (GCI) is a trusted reference that measures the commitment of countries to cybersecurity at a global level – to raise awareness of the importance and different dimensions of the issue (provided by the International Telecommunication Union - ITU). The indicator was last updated in 2021.

The National Cyber Security Index (NCSI) measures a country's readiness to address cyber threats and manage cyber incidents. It is composed of categories, capacities, and indicators (provided by NCSI). The indicator was last updated in January 2023.

The Digital Development Level (DDL) defines the average percentage the country received from the maximum value of both indices (provided by NCSI). The indicator was last updated in January 2023.

The dataset can be used for practising data cleaning, data visualization (on maps and round/bar charts), finding correlations between the indexes and predicting the missing data.

The data was used in the analytical article research The Geography of Cybersecurity: Cyber Threats and Vulnerabilities

In 2024, the number of data compromises in the United States stood at 3,158 cases. Meanwhile, over 1.35 billion individuals were affected in the same year by data compromises, including data breaches, leakage, and exposure. While these are three different events, they have one thing in common. As a result of all three incidents, the sensitive data is accessed by an unauthorized threat actor. Industries most vulnerable to data breaches Some industry sectors usually see more significant cases of private data violations than others. This is determined by the type and volume of the personal information organizations of these sectors store. In 2024 the financial services, healthcare, and professional services were the three industry sectors that recorded most data breaches. Overall, the number of healthcare data breaches in some industry sectors in the United States has gradually increased within the past few years. However, some sectors saw decrease. Largest data exposures worldwide In 2020, an adult streaming website, CAM4, experienced a leakage of nearly 11 billion records. This, by far, is the most extensive reported data leakage. This case, though, is unique because cyber security researchers found the vulnerability before the cyber criminals. The second-largest data breach is the Yahoo data breach, dating back to 2013. The company first reported about one billion exposed records, then later, in 2017, came up with an updated number of leaked records, which was three billion. In March 2018, the third biggest data breach happened, involving India’s national identification database Aadhaar. As a result of this incident, over 1.1 billion records were exposed.

Cyber attacks are a growing concern for small businesses during COVID-19 . Be Protected While You Work. Upgrade Your Small Business's Virus Protection Today! Before going for a Cyber security solutions for small to mid-sized businesses deliver enterprise-level protection.

Download this (Checklist for a Small Firm's Cybersecurity Program 2020-2021) data set to deploy secure functioning of various aspects of your small business including, employee data, website and more.This checklist is provided to
assist small member firms with limited resources to establish a cybersecurity program to identify and assess cybersecurity threats,
protect assets from cyber intrusions,
detect when their systems and assets have been compromised,
plan for the response when a compromise occurs and implement a plan to recover lost, stolen or unavailable assets. 
Train employees in security principles.
Protect information, computers, and networks from malware attacks.
Provide firewall security for your Internet connection.
Create a mobile device action plan.
 Make backup copies of important business data and information.
 Learn about the threats and how to protect your website.
 Protect Your Small Business site.
 Learn the basics for protecting your business web sites from cyber attacks at WP Hacked Help Blog

Created With Inputs From Security Experts at WP Hacked Help - Pioneer In WordPress Malware Removal & Security

In January 2025, a small fintech startup in Austin discovered it had fallen victim to a cyberattack. At first glance, the breach looked like a typical case of credential stuffing. But it wasn’t. The attacker had used an AI-driven system that mimicked the behavioral patterns of employees, learning login habits,...

The Database Security Evaluation System market is experiencing robust growth, driven by the increasing prevalence of cyber threats targeting sensitive data stored in databases. The market's expansion is fueled by the rising adoption of cloud-based databases, the growing need for regulatory compliance (e.g., GDPR, CCPA), and the increasing sophistication of cyberattacks. Small and Medium-sized Enterprises (SMEs) are a significant growth segment, recognizing the critical need for robust database security solutions despite limited budgets. The market is segmented by deployment type (Cloud-Based and On-Premise), with Cloud-Based solutions gaining significant traction due to their scalability, cost-effectiveness, and ease of management. Key players such as Oracle, IBM, and specialized security firms like TechCERT and Xiarch are actively competing in this space, offering a diverse range of solutions tailored to specific industry needs. While the initial investment in database security evaluation systems can be a restraint for some organizations, the long-term cost savings associated with preventing data breaches far outweigh the initial expense. The market's geographic distribution shows a strong presence in North America and Europe, driven by advanced technological infrastructure and stringent data protection regulations. However, growth opportunities are emerging in Asia-Pacific and other developing regions, fueled by increasing digitalization and government initiatives promoting cybersecurity. By 2033, the market is projected to reach substantial size, reflecting a consistent compound annual growth rate (CAGR) driven by the continuous demand for robust database security measures. The competitive landscape is characterized by both established players offering comprehensive security suites and specialized firms focusing on niche solutions. Strategic partnerships, mergers, and acquisitions are expected to shape the market dynamics in the coming years. Continuous innovation in areas such as artificial intelligence (AI) and machine learning (ML) for threat detection and prevention is further driving the adoption of advanced database security evaluation systems. The market is likely to see an increasing focus on integrating security solutions directly within database management systems (DBMS), offering seamless protection and streamlined management. The demand for skilled professionals capable of implementing and managing these systems is also likely to grow, creating opportunities for training and certification programs.

Between the third quarter of 2024 and the second quarter of 2025, the number of records exposed in data breaches in the United States decreased significantly. In the most recent measured period, over 16.9 million records were reported as leaked, down from around 494.17 million in the third quarter of 2024.

View Data Breach Notification Reports, which include how many breaches are reported each year and the number of affected residents.

[227+ Pages Report] Global Cyber Security Market size & share projected to hit a record value of USD 398.3 Billion by 2026 at an anticipated CAGR growth rate of 14.9% during the forecast period 2021-2026. Increasing use of technological measures in the sectors of retails, BSFI, information and technology, and manufacturing will boost the footprint of global cyber security market to a larger footprint.

This Cybersecurity Intrusion Detection Dataset is designed for detecting cyber intrusions based on network traffic and user behavior. Below, I’ll explain each aspect in detail, including the dataset structure, feature importance, possible analysis approaches, and how it can be used for machine learning.

1. Understanding the Features

The dataset consists of network-based and user behavior-based features. Each feature provides valuable information about potential cyber threats.

A. Network-Based Features

These features describe network-level information such as packet size, protocol type, and encryption methods.

1. network_packet_size (Packet Size in Bytes)

   • Represents the size of network packets, ranging between 64 to 1500 bytes.
   • Packets on the lower end (~64 bytes) may indicate control messages, while larger packets (~1500 bytes) often carry bulk data.
   • Attackers may use abnormally small or large packets for reconnaissance or exploitation attempts.

2. protocol_type (Communication Protocol)

   • The protocol used in the session: TCP, UDP, or ICMP.
   • TCP (Transmission Control Protocol): Reliable, connection-oriented (common for HTTP, HTTPS, SSH).
   • UDP (User Datagram Protocol): Faster but less reliable (used for VoIP, streaming).
   • ICMP (Internet Control Message Protocol): Used for network diagnostics (ping); often abused in Denial-of-Service (DoS) attacks.

3. encryption_used (Encryption Protocol)

   • Values: AES, DES, None.
   • AES (Advanced Encryption Standard): Strong encryption, commonly used.
   • DES (Data Encryption Standard): Older encryption, weaker security.
   • None: Indicates unencrypted communication, which can be risky.
   • Attackers might use no encryption to avoid detection or weak encryption to exploit vulnerabilities.

B. User Behavior-Based Features

These features track user activities, such as login attempts and session duration.

1. login_attempts (Number of Logins)

   • High values might indicate brute-force attacks (repeated login attempts).
   • Typical users have 1–3 login attempts, while an attack may have hundreds or thousands.

2. session_duration (Session Length in Seconds)

   • A very long session might indicate unauthorized access or persistence by an attacker.
   • Attackers may try to stay connected to maintain access.

3. failed_logins (Failed Login Attempts)

   • High failed login counts indicate credential stuffing or dictionary attacks.
   • Many failed attempts followed by a successful login could suggest an account was compromised.

4. unusual_time_access (Login Time Anomaly)

   • A binary flag (0 or 1) indicating whether access happened at an unusual time.
   • Attackers often operate outside normal business hours to evade detection.

5. ip_reputation_score (Trustworthiness of IP Address)

   • A score from 0 to 1, where higher values indicate suspicious activity.
   • IP addresses associated with botnets, spam, or previous attacks tend to have higher scores.

6. browser_type (User’s Browser)

   • Common browsers: Chrome, Firefox, Edge, Safari.
   • Unknown: Could be an indicator of automated scripts or bots.

2. Target Variable (attack_detected)

• Binary classification: 1 means an attack was detected, 0 means normal activity.
• The dataset is useful for supervised machine learning, where a model learns from labeled attack patterns.

3. Possible Use Cases

This dataset can be used for intrusion detection systems (IDS) and cybersecurity research. Some key applications include:

A. Machine Learning-Based Intrusion Detection

1. Supervised Learning Approaches

   • Classification Models (Logistic Regression, Decision Trees, Random Forest, XGBoost, SVM)
   • Train the model using labeled data (attack_detected as the target).
   • Evaluate using accuracy, precision, recall, F1-score.

2. Deep Learning Approaches

   • Use Neural Networks (DNN, LSTM, CNN) for pattern recognition.
   • LSTMs work well for time-series-based network traffic analysis.

B. Anomaly Detection (Unsupervised Learning)

If attack labels are missing, anomaly detection can be used: - Autoencoders: Learn normal traffic and flag anomalies. - Isolation Forest: Detects outliers based on feature isolation. - One-Class SVM: Learns normal behavior and detects deviations.

C. Rule-Based Detection

• If certain thresholds are met (e.g., failed_logins > 10 & ip_reputation_score > 0.8), an alert is triggered.

4. Challenges & Considerations

• Adversarial Attacks: Attackers may modify traffic to evade detection.
• Concept Drift: Cyber threats...

Strengthen your cyber defense with our extensive, daily-updated WHOIS database. Accessible in CSV, JSON, and XML, it's a crucial asset for any security strategy.

Healthcare Cyber Security Market Outlook

According to our latest research, the global healthcare cyber security market size in 2024 is valued at USD 17.2 billion, driven by the increasing digitization of healthcare systems and the rising frequency of cyber-attacks targeting sensitive medical data. The market is projected to grow at a CAGR of 16.8% during the forecast period, reaching approximately USD 49.6 billion by 2033. This robust growth is primarily fueled by the proliferation of electronic health records (EHRs), expanding telemedicine adoption, and stringent regulatory mandates for data protection in the healthcare sector.

One of the most significant growth factors for the healthcare cyber security market is the exponential rise in cyber threats and data breaches affecting healthcare organizations globally. With healthcare data being highly valuable on the black market, malicious actors are increasingly targeting hospitals, clinics, insurance companies, and pharmaceutical firms. The proliferation of connected medical devices and the Internet of Medical Things (IoMT) has further expanded the attack surface, making healthcare systems more vulnerable. As a result, organizations are investing heavily in advanced cyber security solutions and services to safeguard patient data, intellectual property, and critical infrastructure, propelling market growth.

Another key driver is the rapid digitization and integration of information technology in healthcare operations. The adoption of electronic health records, telehealth platforms, cloud-based applications, and mobile health apps has transformed patient care delivery but has also introduced new vulnerabilities. Regulatory frameworks such as HIPAA in the United States, GDPR in Europe, and similar mandates worldwide require healthcare providers to implement robust data protection strategies. This regulatory pressure, combined with the reputational and financial risks associated with data breaches, is compelling healthcare organizations to prioritize cyber security investments, further accelerating market expansion.

The growing complexity of healthcare networks, coupled with the need for interoperability and real-time data sharing, has created additional challenges in maintaining security. As healthcare systems integrate third-party vendors, cloud platforms, and mobile devices, the risk of unauthorized access and data leakage increases. The demand for comprehensive security solutions, including network security, endpoint security, application security, and cloud security, is surging. Moreover, the shift towards value-based care and the rise of remote patient monitoring are encouraging healthcare stakeholders to adopt proactive and holistic cyber security frameworks to ensure patient safety and operational continuity.

From a regional perspective, North America dominates the healthcare cyber security market, accounting for the largest revenue share in 2024, followed by Europe and Asia Pacific. The United States, in particular, leads the market due to high healthcare IT adoption, stringent regulatory requirements, and a significant number of cyber incidents reported annually. Europe is witnessing robust growth, driven by GDPR compliance and increasing investments in healthcare IT infrastructure. Meanwhile, the Asia Pacific region is emerging as a high-growth market, fueled by rapid digital transformation in healthcare, rising awareness about data protection, and government initiatives to strengthen cyber security frameworks. Latin America and the Middle East & Africa are also experiencing steady growth, albeit at a slower pace, as healthcare organizations in these regions gradually enhance their cyber security capabilities.

Component Analysis

The healthcare cyber security market is segmented by component into solutions and services, each playing a critical role in the overall security posture of healthcare organizations. Solutions encompass a wide range of software and hardware off

Explore the burgeoning Database Security Tools market, projected to reach $3084 million by 2033 with a 7.3% CAGR. Discover key insights into market drivers, trends, and growth across enterprise and cloud solutions.