---
title: tl;dr ForgeRock’s 2021 Consumer Identity Breach Report
description: "Tl;dr-series; this time: A quick summary of ForgeRock’s 2021 Consumer Identity Breach Report by CMO Dr. Heiko Klarl. Read Now!"
image: https://blog.iam-excellence.com/hubfs/Imported_Blog_Media/Webinar-Recording-Speeding-Up-Zero-Trust-Delivery.jpg
---

 Sep 23, 2021 12:00:00 AM

# tl;dr ForgeRock’s 2021 Consumer Identity Breach Report

[ iC Consult ](https://blog.iam-excellence.com/ic-consult-blog/author/ic-consult)

Share: [facebook-f icon ](http://www.facebook.com/share.php?u=https://blog.iam-excellence.com/ic-consult-blog/en/resource/tldr-forgerock-2021-consumer-identity-breach-report) [linkedin-in icon ](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.iam-excellence.com/ic-consult-blog/en/resource/tldr-forgerock-2021-consumer-identity-breach-report) [Twitter icon ](https://twitter.com/intent/tweet?url=https://blog.iam-excellence.com/ic-consult-blog/en/resource/tldr-forgerock-2021-consumer-identity-breach-report) [pinterest-p icon ](http://pinterest.com/pin/create/link/?url=https://blog.iam-excellence.com/ic-consult-blog/en/resource/tldr-forgerock-2021-consumer-identity-breach-report) [envelope icon ](mailto:?body=https://blog.iam-excellence.com/ic-consult-blog/en/resource/tldr-forgerock-2021-consumer-identity-breach-report)

In this year´s ForgeRock Consumer Identity Report [1], Eve Mahler, CTO of ForgeRock, discusses the rapidly growing number of identity breaches in healthcare and financial services, and gives recommendations on how to prevent them. Here is my quick tl;dr summary:

## **Worldwide Increase in Breaches**

Even during Covid-19, malicious actors remained as active as ever: Most notably, attacks involving usernames and passwords increased by a staggering 450% over 2019, translating into more than 1 billion compromised records in the U.S. alone.

A closer look at vertical segments reveals that healthcare providers were the biggest target by a large margin: The healthcare industry accounted for 34% of all breaches, followed by financial services with 12%. Seeing those two verticals at the top of the standings should not come as a surprise, as they handle the most sensitive and valuable personal data.

## **Attacks by Type and Region**

When looking at the prevalent attack types, unauthorized access was the most reported type of breach (43%) for the third year in a row. Another distinct, yet not surprising trend during Covid-19 was a significant increase in attacks on remote workers, especially by phishing attacks to gain access to user credentials (25%, up from 14% in 2019). 

Third on the list, ransomware attacks remain as dangerous as ever. ForgeRock reports an overall increase to 17% (up from 10% in 2019) which doesn’t sound too drastic at first. But once you break down the regional and vertical numbers, you can see that e.g., financial services in UK reported a dramatic increase by 471% over 2019. 

Equally alarming numbers come from Germany’s critical infrastructure providers: ForgeRock documented a grand total of 419 reported data breaches at critical infrastructures, a 67% increase over 2019. This is exacerbated by the fact that a significant portion of breaches is only discovered after several months, when attackers had plenty of time to explore the network laterally and increase their damage potential. 

## **Three Things You Must Do – Stop, Drop, Clean-up**

Based on these numbers, ForgeRock gives valuable actionable recommendations on how to reduce the breach threat: First of all, users need to stop using static passwords, as these are the ultimate attack vector. As a second task, organizations need to drop into their users’ experience and determine the most convenient and secure password less authorization method. And finally, they should clean-up user roles and reduce them to the most necessary. 

## **The Biggest Takeaway: Zero Trust is a Necessity **

Seeing that attacks can come from anywhere, organizations must be able to verify the identity of each employee, customer, or system on the network at any time. They need to combine modern hybrid IAM (Identity and Access Management) solutions with a Zero Trust strategy to sustainably limit access and protect data and resources. Strong authentication and authorization prevent attackers from gaining higher privileges and stop them from moving laterally through a network.  

Another important takeaway is that no company is too small to be a valuable target, and therefore, even smaller organizations should do all they can to improve their security posture, including using password less techniques and other Zero Trust-friendly measures.

## **The tl;dr-series for IAM**

With the tl;dr-series for IAM (too long; didn’t read) I try to summarize important and interesting articles that came across my reading list. Feel free to reach out with feedback and recommendations of articles that matter. 

[Zero Trust](https://blog.iam-excellence.com/ic-consult-blog/tag/zero-trust), [ForgeRock](https://blog.iam-excellence.com/ic-consult-blog/tag/forgerock), [Remote Access](https://blog.iam-excellence.com/ic-consult-blog/tag/remote-access), [Passwordless](https://blog.iam-excellence.com/ic-consult-blog/tag/passwordless), [Cyber Attacks](https://blog.iam-excellence.com/ic-consult-blog/tag/cyber-attacks)

## Related posts

[![](https://blog.iam-excellence.com/hs-fs/hubfs/Imported_Blog_Media/Securing-Against-Social-Engineering-and-Phishing-Attacks_ER-Resource-Card1.jpg?height=200&name=Securing-Against-Social-Engineering-and-Phishing-Attacks_ER-Resource-Card1.jpg) ](https://blog.iam-excellence.com/ic-consult-blog/en/resource/combat-unauthorized-access-with-ai-driven-identity)

[ForgeRock](https://blog.iam-excellence.com/ic-consult-blog/tag/forgerock), [Generative AI](https://blog.iam-excellence.com/ic-consult-blog/tag/generative-ai), [NIS2](https://blog.iam-excellence.com/ic-consult-blog/tag/nis2), [User Experience](https://blog.iam-excellence.com/ic-consult-blog/tag/user-experience), [Cyber Attacks](https://blog.iam-excellence.com/ic-consult-blog/tag/cyber-attacks)

## [Combat Unauthorized Access with AI-Driven Identity](https://blog.iam-excellence.com/ic-consult-blog/en/resource/combat-unauthorized-access-with-ai-driven-identity)

[iC Consult](https://blog.iam-excellence.com/ic-consult-blog/author/ic-consult) 

 Feb 13, 2024 12:00:00 AM

Digital transformation requires organizations to collaborate freely throughout the value chain. So...

[ Read more ](https://blog.iam-excellence.com/ic-consult-blog/en/resource/combat-unauthorized-access-with-ai-driven-identity)

[![](https://blog.iam-excellence.com/hs-fs/hubfs/Imported_Blog_Media/IAM-under-attack_Article_ER-Resource-Card-1.jpg?height=200&name=IAM-under-attack_Article_ER-Resource-Card-1.jpg) ](https://blog.iam-excellence.com/ic-consult-blog/en/resource/tldr-forrester-study-beyond-boundaries)

[Zero Trust](https://blog.iam-excellence.com/ic-consult-blog/tag/zero-trust), [IAM Investment](https://blog.iam-excellence.com/ic-consult-blog/tag/iam-investment), [IAM Strategy](https://blog.iam-excellence.com/ic-consult-blog/tag/iam-strategy), [Remote Access](https://blog.iam-excellence.com/ic-consult-blog/tag/remote-access), [Forrester](https://blog.iam-excellence.com/ic-consult-blog/tag/forrester)

## [tl;dr Forrester Study: Beyond Boundaries](https://blog.iam-excellence.com/ic-consult-blog/en/resource/tldr-forrester-study-beyond-boundaries)

[iC Consult](https://blog.iam-excellence.com/ic-consult-blog/author/ic-consult) 

 Nov 11, 2021 12:00:00 AM

Forrester’s recent Beyond Boundaries [1] report asked 426 security professionals, 422 executives...

[ Read more ](https://blog.iam-excellence.com/ic-consult-blog/en/resource/tldr-forrester-study-beyond-boundaries)

[![](https://blog.iam-excellence.com/hs-fs/hubfs/Imported_Blog_Media/2-1.jpg?height=200&name=2-1.jpg) ](https://blog.iam-excellence.com/ic-consult-blog/en/resource/user-access-reviews-the-unsung-hero-of-identity-and-access-management)

[User Access Review](https://blog.iam-excellence.com/ic-consult-blog/tag/user-access-review), [Compliance](https://blog.iam-excellence.com/ic-consult-blog/tag/compliance), [IAM Strategy](https://blog.iam-excellence.com/ic-consult-blog/tag/iam-strategy), [Audit](https://blog.iam-excellence.com/ic-consult-blog/tag/audit)

## [User Access Reviews: The Unsung Hero of Identity and Access Management](https://blog.iam-excellence.com/ic-consult-blog/en/resource/user-access-reviews-the-unsung-hero-of-identity-and-access-management)

[iC Consult](https://blog.iam-excellence.com/ic-consult-blog/author/ic-consult) 

 Mar 27, 2024 12:00:00 AM

In today’s digital landscape, Identity and Access Management (IAM) is not just a technology issue;...

[ Read more ](https://blog.iam-excellence.com/ic-consult-blog/en/resource/user-access-reviews-the-unsung-hero-of-identity-and-access-management)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "iC Consult",
    "url" : "https://blog.iam-excellence.com/ic-consult-blog/author/ic-consult"
  },
  "dateModified" : "2024-10-09T11:46:49.839Z",
  "datePublished" : "2021-09-22T22:00:00.000Z",
  "headline" : "tl;dr ForgeRock’s 2021 Consumer Identity Breach Report",
  "image" : [ "https://blog.iam-excellence.com/hubfs/Imported_Blog_Media/Webinar-Recording-Speeding-Up-Zero-Trust-Delivery.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.iam-excellence.com/ic-consult-blog/en/resource/tldr-forgerock-2021-consumer-identity-breach-report",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.iam-excellence.com/hubfs/ic_consult_logo_rgb-3.png"
    },
    "name" : "iC Consult Group GmbH"
  }
}
```