Lookout Data Shows Credential Theft Mobile Attacks on the Rise in U.S. Government Agencies

SAN FRANCISCO, November 2, 2022 – Lookout, Inc., the endpoint to cloud security company, today released its 2022 Government Threat Report which examines the most prominent mobile threats affecting federal, state and local governments in the United States. Lookout data reveals mobile phishing and device vulnerability risk within U.S. government agencies has increased since 2021. According to a Lookout analysis of data specific to federal, state, and local government entities from the Lookout Security Graph, nearly 50% of phishing attacks aimed at government personnel in 2021 sought to steal credentials, up from 30% in 2020.

In addition to the increase in phishing attacks for government employees, the report findings include:

• Federal, state, and local governments increased their reliance on unmanaged mobile devices at a rate of 55% from 2020 to 2021, indicating a move toward BYOD to support a larger remote workforce.
• 1 in 8 government employees were exposed to phishing threats. With more than two million federal government employees alone, this represents a significant potential attack surface as it only takes one successful phishing attempt to compromise an entire agency.
• There was a steady rise in mobile phishing encounter rates for state and local governments across both managed and unmanaged devices, increasing at rates of 48% and 25% respectively from 2020 to 2021. This steady climb continued through the first half of 2022. 
• Nearly 50% of state and local government Android users are running outdated operating systems, exposing them to hundreds of device vulnerabilities. This is an improvement versus 99% in 2020.

Government organizations store and transmit a variety of sensitive data, the security of which is essential to the wellbeing of hundreds of millions of people. In the case of government organizations, the potential fallout from a breach that results in leaked data, stolen credentials or a forced halt to operations due to ransomware can have a disproportionate impact compared to a typical cybersecurity incident. 

Additionally, government employees use iOS, Android and ChromeOS devices everyday to stay productive and increase efficiency. This makes them targets for cyberattackers as their devices are a treasure trove of data and a gateway to government infrastructure. Only a modern endpoint protection solution can detect mobile threats in apps, device operating systems and network connections, while also protecting against credential harvesting and malware delivery attacks through phishing. Due to the personal nature of smartphones, tablets and Chromebooks, endpoint security must protect the user, the device and the organization while respecting user privacy. 

“It’s more important than ever for government agencies to keep pace with the evolution of the cyber threat environment,'' said Tony D’Angelo, vice president, Americas Public Sector, Lookout. “Regardless of whether devices are managed, protecting these modern endpoints requires a different approach — one that is built from the ground up for mobile. Only a modern endpoint protection solution can detect mobile threats in apps, device operating systems, and network connections while also protecting against phishing attacks that steal credentials and deliver malware.”

The Lookout Government Threat Report is based on analysis of data specific to federal, state, and local government organizations from the Lookout Security Graph. The graph, which includes telemetry data from analysis of more than 205 million devices and more than 175 million apps, enabled Lookout to identify and break down the most prominent mobile threats agencies faced in 2021 and the first half of 2022. Information used in this report was compiled from de-identified, aggregated Lookout data. 

Download the 2022 Lookout Government Threat Report here.

Additional Resources:

• To learn more, visit www.lookout.com.
• Take our free online Data Risk Assessment.
• Follow Lookout on its blog, LinkedIn and Twitter.
• Listen to Security Soapbox, the Lookout podcast covering privacy, security, and everything in between.

About Lookout

Lookout, Inc. is the endpoint to cloud security company purpose-built for the intersection of enterprise and personal data. We safeguard data across devices, apps, networks and clouds through our unified, cloud-native security platform — a solution that's as fluid and flexible as the modern digital world. By giving organizations and individuals greater control over their data, we enable them to unleash its value and thrive. Lookout is trusted by enterprises of all sizes, government agencies and millions of consumers to protect sensitive data, enabling them to live, work and connect — freely and safely. To learn more about the Lookout Cloud Security Platform, visit www.lookout.com and follow Lookout on our blog, LinkedIn and Twitter.

‍Contact Lookout PR: press@lookout.com