According to a new survey, approximately 50% of phishing attacks aimed at government personnel in 2021 sought to steal credentials, an increase of 30% in 2020.

Lookout, Inc.’s 2022 Government Threat Report examines the most prominent mobile threats affecting the United States federal, state and local governments. Lookout data reveals that the risk of mobile phishing and device vulnerability within U.S. government agencies has increased since 2021.

The Lookout Government Threat Report is based on an analysis of data specific to federal, state, and local government organizations from the Lookout Security Graph. The graph includes telemetry data from analyzing more than 205 million devices and over 175 million apps.

In addition to the increase in phishing attacks for government employees, the report findings include the following:

• Federal, state, and local governments increased their reliance on unmanaged mobile devices at a rate of 55% from 2020 to 2021, indicating a move toward BYOD to support a larger remote workforce.
• 1 in 8 government employees were exposed to phishing threats. With more than two million federal government employees alone, this represents a significant potential attack surface as it only takes one successful phishing attempt to compromise an entire agency.
• There was a steady rise in mobile phishing encounter rates for state and local governments across both managed and unmanaged devices, increasing to 48% and 25%, respectively, from 2020 to 2021. This steady climb continued through the first half of 2022. 
• Nearly 50% of state and local government employees are running outdated Android operating systems, exposing them to hundreds of device vulnerabilities —  an improvement versus 99% in 2021.
  

Government organizations store and transmit various sensitive data, the security of which is essential to the well-being of hundreds of millions of people. In the case of government organizations, the potential fallout from a breach that results in leaked data, stolen credentials, or a forced halt to operations due to ransomware can have a disproportionate impact compared to a typical cybersecurity incident. 

Additionally, government employees use iOS, Android and ChromeOS devices daily to stay productive and increase efficiency. This makes them targets for cyberattackers as their devices are a treasure trove of data and a gateway to government infrastructure. “It’s more important than ever for government agencies to keep pace with the evolution of the cyber threat environment,” said Tony D’Angelo, vice president, Americas Public Sector, Lookout. “Regardless of whether devices are managed, protecting these modern endpoints requires a different approach — one that is built from the ground up for mobile. ”

Download the 2022 Lookout Government Threat Report here.