Cybersecurity in Transition: Insights from the 2025 DSIR Report

Editor’s Note: The 2025 Data Security Incident Response Report from BakerHostetler is a timely and data-rich resource that resonates deeply with professionals working at the crossroads of cybersecurity, information governance, and eDiscovery. As the regulatory and threat landscapes grow more complex, this report offers clarity through precision metrics, grounded insights, and a strategic lens on risk and response. With over 1,250 incidents informing its conclusions, the DSIR is not just an annual snapshot—it’s a forward-facing tool for assessing resilience, adjusting operational tactics, and preparing governance frameworks for the realities of 2025 and beyond. The report’s integration of incident trends, forensic economics, litigation patterns, and vendor dynamics makes it essential reading for legal advisors, CISOs, privacy officers, and incident response leaders shaping their strategies in an age defined by both technological promise and persistent vulnerability.

Industry News – Cybersecurity Beat

Cybersecurity in Transition: Insights from the 2025 DSIR Report

ComplexDiscovery Staff

In the constantly evolving theater of cybersecurity operations, where the terminology of defense is often recycled but the vectors of attack remain all too familiar, BakerHostetler’s 2025 Data Security Incident Response (DSIR) Report delivers a compelling recalibration of threat intelligence and organizational resilience. This 11th annual edition, emerging from a year of more than 1,250 incidents guided by the firm’s Digital Assets and Data Management (DADM) Practice Group, doesn’t just document the breaches—it distills the landscape into insights meant to be acted upon, not just admired.

This year’s report opens with a tone of cautious optimism. Ransomware, a dominant threat vector over the past five years, is no longer spiraling unchecked. Instead, successful attacks have declined, recovery timelines have shortened, and ransom payments have notably dropped—by 33 percent year-over-year. The average payment in 2024 landed at $501,338, a marked improvement from the $747,651 recorded in 2023. BakerHostetler credits this downturn to improved backup and recovery planning, effective collaboration with law enforcement, and a maturing ecosystem of breach response partners, from forensic firms to payment facilitators. However, the report makes clear that while fewer organizations pay for decryptors, many still find themselves paying to prevent the public release of stolen data—pointing to a shift, not a disappearance, of extortion pressures.

In a similar arc of refinement, the costs of forensic investigations continue their downward trajectory. Forensic expenses reached a three-year low in 2024, with the average cost across the 20 largest network intrusion matters dropping from $550,000 to $273,000. This cost reduction is not an anomaly but the product of evolving practices: pre-deployed endpoint detection and response (EDR) tools, better triage capabilities, and a more competitive and efficient forensic market have all played key roles. Organizations that deploy EDR comprehensively prior to an incident realize faster detection, streamlined containment, and more precise scope analysis—outcomes that resonate well with budget-conscious boards and risk committees alike.

Yet amid these positives, the report surfaces a jarring counterpoint: a threefold increase in wire fraud losses, soaring from $35 million in 2023 to $109 million in 2024. This steep rise in fraud is especially pronounced in the business and professional services and financial sectors, where average fraudulent transfers now exceed $1.25 million. BakerHostetler highlights a critical risk factor in delayed discovery—the median time from initial account compromise to recognition of a fraudulent transfer is a staggering 18 days, compared to the three-day median across all incidents. The implications for fund recovery are grim. In a threat landscape often dominated by ransomware, this quiet but destructive growth in transactional fraud poses a fresh challenge for incident response teams and financial controllers alike.

Another constant, if disheartening, theme is healthcare’s vulnerability. For the 11th consecutive year, healthcare—including biotech and pharma—led all sectors in a number of reported incidents, comprising 36 percent of the total. This sector also bore the highest average ransom payment, at $847,875. The systemic fragility exposed by attacks like the Change Healthcare breach continues to ripple across the industry, underscoring the intersection of operational disruption, sensitive data exposure, and regulatory scrutiny.

Litigation trends, however, offer a momentary reprieve. The frequency of class action filings following breach notifications declined slightly—51 lawsuits out of 518 disclosure events, down from 58 the prior year. For the first time in five years, this metric reversed course. The slowing velocity of privacy statute lawsuits, particularly those targeting web tracking and cookie technologies, may indicate some degree of litigation fatigue or evolving strategy among plaintiffs’ counsel. Still, the underlying legal exposure remains—especially with the increase in settlements and ongoing regulatory attention from state attorneys general and federal bodies such as the Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services (HHS).

The DSIR report also devotes significant attention to the role of social engineering in modern breaches. Techniques like spear phishing, vishing, multifactor authentication (MFA) fatigue, and direct social manipulation of help desk staff are supplanting malware as the tools of choice for threat actors. With compromised credentials, attackers are bypassing perimeter defenses and exploiting insufficient identity and access controls. The emphasis, therefore, shifts from detection to denial—limiting the damage potential of breached accounts by enforcing least-privilege principles and rigorous role-based access control.

Interestingly, while artificial intelligence (AI) continues to dominate conversations in both technological and regulatory domains, the DSIR 2025 Report notes that AI has not yet emerged as a primary tool in the execution of cyberattacks. Despite its prominence in public discourse and policy debates, threat actors are still relying on human manipulation, compromised credentials, and well-worn entry points. This observation doesn’t downplay AI’s potential to impact the threat landscape—particularly in areas like phishing automation or synthetic identity creation—but it does emphasize that the most common risks remain rooted in exploitable human behavior and operational lapses. For practitioners, the message is clear: don’t get distracted by the horizon while leaving current vulnerabilities unaddressed.

Vendor incidents, representing 27 percent of cases tracked, remain an enduring source of frustration. The report reiterates the absence of a silver bullet: third-party risk management must be formalized, actively maintained, and integrated into core governance. While incidents like those involving Change Healthcare and MOVEit are high profile, the root issue lies deeper—in overlooked offboarding protocols, stale contracts, and unclear data deletion responsibilities.

For the cybersecurity, information governance, and eDiscovery communities, the implications of the DSIR 2025 Report are layered. The decreasing cost of forensic response and the stabilization of ransomware represent genuine progress. But the surge in wire fraud and the persistence of fundamental missteps—like incomplete EDR deployment or inadequate post-incident remediation—signal the need for ongoing vigilance. Just as no EDR tool can monitor what it’s not configured to see, no organization can afford to let confidence in its response plans substitute for continuous testing and adaptation.

What emerges from BakerHostetler’s latest installment is a landscape in transition—not one of triumph, but of informed recalibration. Organizations are not merely reacting but beginning to anticipate. Risk is not eliminated, but increasingly contextualized. The question is no longer just how to respond, but how to recover smarter and rebuild stronger.

For professionals navigating the intersection of law, data, and security, the 2025 DSIR Report is not just a chronicle of breaches—it’s a blueprint for better decisions in the age of cyber uncertainty. And as that uncertainty persists, so must the commitment to readiness, resilience, and reflection.

News Sources

• BakerHostetler launches 2025 Data Security Incident Response Report (BakerHostetler)
• BakerHostetler. (2025, April 15). 2025 Data Security Incident Response Report. Retrieved from https://www.bakerlaw.com/DigitalAssetsDataManagement

Assisted by GAI and LLM Technologies

Additional Reading

• ENISA Report Warns of Rising Cyber Risks to Orbital Infrastructure
• Oracle’s Alleged Breach and the Rise of Cybersecurity Concerns in Corporate Cloud Environments
• Jaguar Land Rover Breached: The Persistent Threat of Ransomware in the Automotive Industry

Source: ComplexDiscovery OÜ