Human Error Data Breaches Surge 43% in Five Years
This increase highlights the growing role of staff training in organisational cyber security risk. This issue isn’t the responsibility of a single stakeholder, but highlights the need for companies to strengthen awareness, processes and security culture among their staff from the top down.
Using the latest data from the ICO, between 2020 and 2025, we’ve outlined the most common human error types, the industries at the most risk and the length of time it takes to report each breach.
Most Common Human Error Incident Types
Data breaches can happen for many reasons, but they're often caused by a simple lack of awareness during everyday work. One of the most common types of human error incidents is data being emailed to an incorrect recipient, with 11,214 reported incidents falling under this category.
At just under half that number, 4,750 reported incidents include data posted or faxed to an incorrect recipient.
The third-highest number of incidents comes from organisations failing to redact crucial documents before sending them externally, with a total of 3,353 reported breaches between 2020 and 2025.
Rounding out the top five most common incidents caused by human error is failure to use blind carbon copy (bcc) at 2,060, followed by the verbal disclosure of personal data at 1,826.
With so many incidents caused by everyday errors, this highlights the responsibility of organisations to create clear policies and training for employees on data handling and best practices.
Industries with the Most Human Error Data Breaches
Data breaches can affect a wide range of industries, but they are especially detrimental to key sectors where data privacy is paramount.
One of the sectors most vulnerable to data breaches due to human error is health, with 5,054 of the total recorded incidents occurring in the health sector, putting key patient information at risk.
The second most vulnerable sector is education and childcare, with 4,180 of the reported breaches being from this sector.
Local government and legal sectors come next with 3,457 and 2,495 breaches respectively, while the finance, insurance and credit sector has a total of 2,129 reported incidents.
Organisations could lower these statistics by providing updated data privacy training informed by risk assessments carried out by cyber security staff.
How Long Does It Take to Report Human Error Data Breaches?
The faster an incident is reported, the less exposed an organisation becomes to data theft. This means fast remediation is essential in data protection.
The largest share of incidents, 38% (10,077) of the total number, were reported within 24 to 72 hours after the data breach had been discovered.
20% of incidents (5,165) were reported within 72 hours to one week, while 26% (6,770) were reported within less than 24 hours.
Incidents that took more than one week to report are the least common, at 17% (4,352) of total incidents reported.
What this tells us is that while incidents are reported more commonly within a week, organisations could be doing more to help train staff and remediation teams in fast reporting and incident response.
How AI Tools Are Creating New Risks
New technologies, like AI, are also creating new opportunities for human error. One report by Verizon found that 15% of employees regularly use generative AI tools on work devices and nearly three-quarters use their personal accounts.
The NCSC has now specifically warned that employees transferring sensitive information into consumer AI services can increase the likelihood of data breaches, loss of intellectual property and regulatory breaches.
But in truth, the onus of protecting against data breaches can’t fall squarely on the shoulders of employees, and it’s up to organisations to have a robust cyber security and data protection plan fully equipped with skilled experts, risk assessments and employee training to ensure most employees are properly trained in data handling practices and identifying targeted social engineering attacks.
How Bridewell Can Help
Bridewell offers a range of fully realised Data Privacy services to protect your organisation against potential social engineering attacks and a framework to train staff on general data protection best practices.
With Bridewell, protect your organisation from data breaches involving sensitive company or customer data, and stay in line with GDPR and other data protection regulations.
Speak To Our Data Privacy Experts
Related Blogs
Methodology
To inform our study, we used the latest data from the ICO, between 2020 and 2025 to identify the following:
- Whether the number of human error-related data breach records are on the rise or falling.
- Which incident types are the most common.
- Which sectors have the highest incident rates.
- How long the breaches took to report (and whether they were within the 72-hour target).
For more information on the specifics of each potential incident, we’ve used a glossary of incident types.
Blogs
Blogs
