Arts, Entertainment and Recreation
NAICS 71

Summary

The Use of stolen credentials, Phishing and Ransomware continue to play big roles in this industry. Compromised Medical information was seen at an unexpectedly high level as well.

Frequency

7,065 incidents, 109 with confirmed data disclosure

Top Patterns

System Intrusion, Basic Web Application Attacks, and Miscellaneous Errors represent 83% of breaches

Threat Actors

External (70%), Internal (31%), Multiple (1%) (breaches)

Actor Motives

Financial (100%) (breaches)

Data compromised

Personal (83%), Credentials (32%), Medical (26%), Other (18%) (breaches)

Top IG1 Protective Controls

Security Awareness and Skills Training (14), Secure Configuration of Enterprise Assets and Software (4), Access Control Management (6)

While the way in which we consumed entertainment changed this year, hopefully temporarily, attackers continued to follow the same winning combination that they’ve been using for the last few years in this industry. Namely, targeting web applications and utilizing malware to its fullest extent. And of course, there was the occasional human blunder that serves to keep life interesting.

System Intrusion, Web Applications and Errors are more or less tied for the top ranking. Their combined weight accounts for 83% of the breaches in this sector. This is in line with the trend set in previous years, and what we saw in last year’s report (Figure 99). With that in mind, it is perhaps only to be expected that action types such as the Use of stolen credentials, Ransomware, Phishing and Misconfiguration were responsible for most breaches (Figure 100).