Two fifths of the world's critical infrastructure providers have been hacked

More than two fifths of critical infrastructure providers worldwide, including water companies, have suffered a cyber breach, according to a report from defence and security firm Thales. The report identifies a strong correlation between breached organisations and compliance.

Thales, in its 2024 Data Threat Report, found that 42% of critical infrastructure organisations (CIOs) had experienced data breaches in the past year, with 93% reporting an increase in numbers of attacks. Nearly one in four had been victims of ransomware attacks, with nearly half of those paying the ransom.

Thales reported that just over a third of cloud-based breaches arose from “human error” with “exploiting a known vulnerability” accounting for 31%.

The report said 84% of CIOs that had failed a compliance audit in the preceding 12 months had “experienced a breach in their history”, while only 17% of those that had not failed a compliance audit had any breach history. 

It went on to say the shift to cloud environments has “proved problematic for CIOs”. It calculated that 51%  thought that managing security in the cloud was “more complex than managing security within on-premise environments”.

Managing director of cyber security and trust at Thales UK, Tony Burton, said: “Critical National Infrastructure – from the utilities that households and businesses rely upon, to the telecommunications and transport systems that keep society running... face very tangible consequences should a breach be successful.”