[ecdavis]

This page is informative: https://www.oaic.gov.au/privacy/notifiable-data-breaches/not...

> Just over half (54%) of cyber incidents involved malicious actors gaining access to accounts using compromised or stolen credentials.

My experience has been that most attacks are not that sophisticated and tend to target poor practices within organisations.