From Verizon's tenth (2017 ) annual breach report
Quote:

In addition, half of all breaches involved stolen or easily-guessable passwords.

Many of these could have been prevented with basic security hygiene.

"We get upset that we still have so many lost and stolen devices as data breaches," he said. "In 2017, it's not bleeding edge technology to encrypt mobile devices. It would save a lot of headaches if they could encrypt those devices -- they wouldn't have to report it, just have the loss of the cost of the asset."

Similarly, two-factor authentication could have stopped many of the attacks based on using leaked passwords or passwords recorded by keystroke loggers.