Phishing Is Responsible for Most of the Recent PII Breaches: True or False?

The answer: True (on the training)

For the DoD/DHA "Identifying and Safeguarding PII" awareness course, the graded answer to this statement is True. The training presents phishing as the leading cause behind most recent breaches of personally identifiable information (PII), and it uses that framing to reinforce the required behavior: recognize suspicious messages, do not click, and report exposed PII right away.

The logic the course wants you to absorb is a cause-and-effect chain. Phishing emails and messages trick employees into handing over credentials or opening malicious attachments. Those stolen credentials or malware footholds then give attackers access to systems holding names, Social Security numbers, dates of birth, and medical records. In that chain, phishing is the initial access vector that makes the downstream data theft possible, which is why the training attributes most breaches to it.

The real-world nuance

Security professionals will note that the statement is a simplification, and this is where the exam answer and reality gently diverge. Industry breach reports (such as the annual Verizon DBIR) show that a very large share of breaches involve the human element, of which phishing and other social engineering are the biggest single slice, but not always a clean majority of all breaches. Other major causes include misconfigured databases, unpatched vulnerabilities, insider mistakes, lost or stolen devices, and third-party compromises.

So the accurate statement is that phishing is among the leading causes, and frequently the single most common initial vector, of PII breaches. For the purposes of the awareness quiz, though, mark True, because the training is teaching a defensive mindset rather than publishing precise statistics. Understanding both the expected answer and the nuance is what actually protects data.

What to do when you find exposed PII

The more important lesson behind the question is the correct response. If you discover PII exposed, whether in a misdirected email, an open shared drive, a public website, or a lost document, the required steps are:

1. Do not download, forward, share, or delete the data. Altering it can destroy evidence or spread the exposure.
2. Report immediately to your supervisor, your organization's privacy officer, and your IT security or help desk. In the DoD context this means notifying the chain of command and the privacy office without delay.
3. Document what you saw, where, and when, so responders can contain it.
4. Follow incident-response guidance and let the designated team handle notification and remediation.

Speed matters because breach-notification laws and DoD policy impose tight reporting timelines. The single wrong move is to ignore it or try to fix it yourself. Report first, and let trained responders investigate. That behavior, more than memorizing True or False, is the real point of the training.