The actively exploited defect, triggered by an attacker’s use of a publicly available sample machine key, underscores the vendor and customers’ poor configuration practices.

No personally identifiable information was compromised in the incident, the bureau said.

Verizon’s DBIR has emerged in the past generation as a reliable way of assessing corporate cybersecurity threats and defenses.