Identity protection services see a unique slice of the threat landscape. Their support queues fill up when attackers succeed, their fraud alerts spike when new campaigns launch, and their most-read articles reveal which threats are actually hitting people's wallets. IdentityIQ recently published a roundup of its ten most-read security topics from 2021. Reading that list through a threat intelligence lens produces something useful: a snapshot of which attack patterns dominated—and how well those patterns have aged.
The short answer is: they aged remarkably well. Most of the techniques IdentityIQ's readers were searching for help with remain active threats today. That tells us something about the pace of attacker adaptation versus defender adaptation.
The short version
- Fake shopping sites and holiday-themed scams topped IdentityIQ's 2021 reader interest
- Ransomware at Cloudstar signaled supply chain risk becoming personal for consumers
- Account takeover emerged as a favored monetization path after credential theft
- Hospital data breaches highlighted third-party risk in critical infrastructure
- Password security remained a persistent gap despite long-standing guidance
Why This List Still Matters
The IdentityIQ roundup covers familiar ground for anyone tracking cybercrime. Gift card scams, fake shopping portals, social media over-sharing—these aren't new problems. They persist because they work. The list essentially confirms what threat intelligence teams already track: financially motivated attackers favor low-complexity, high-volume techniques that exploit human behavior rather than cutting-edge vulnerability chains.
Cloudstar's ransomware incident stands out. A provider of digital services for the real estate sector, Cloudstar's compromise affected title insurance companies, law firms, and ultimately homebuyers and sellers caught in transaction delays. For cybersecurity professionals, this wasn't just another ransomware story—it was a case study in how a supply chain failure generates downstream victims who never had a direct relationship with the compromised vendor. The question IdentityIQ's readers were asking—"am I at risk from this?"—reflects a broader realization that third-party risk is personal.
Hospital data breaches occupied another slot in that top-ten list. Healthcare organizations store high-value data (medical records, insurance information, Social Security numbers) and often run legacy systems that are difficult to patch. For an attacker, a hospital breach offers a richer harvest than most consumer targets. For readers, the practical concern was simpler: what happens to my data when a provider I trusted gets raided?
Our Analysis: What This Means for You
The IdentityIQ readership data reveals a gap between what attackers actually do and what defenders prioritize. Enterprises often focus on sophisticated campaigns, zero-days, and nation-state threats. Meanwhile, credential theft, phishing for personal accounts, and fake storefronts continue generating steady profit for criminal operators.
This matters for two reasons. First, your employees bring personal attack surfaces to work. A compromised personal email account often leads to password reuse pivots into corporate systems. Second, the same scam techniques that fool consumers (fake holiday deals, gift card pressure, spoofed support calls) increasingly appear in business contexts. The gap between "personal" and "corporate" threat intelligence is narrowing.
Account takeover deserves particular attention. Attackers don't need to breach a network when they can take over an existing account that already has permissions. Multi-factor authentication has raised the bar, but not uniformly. Legacy authentication on cloud services, recovery flows that rely on SMS, and API keys stored in personal devices remain exploitable entry points.
Who Should Care
Security professionals:** Use top-read topics as threat intelligence signal. When readers are searching for help with fake shopping sites and gift card scams, that's not noise—it's evidence of what actually works at scale.
IT administrators at healthcare organizations:** Third-party vendor access to patient records deserves the same scrutiny you apply to your internal systems. Healthcare fraud using stolen medical identities is harder to detect than credit fraud, and patients rarely scrutinize their billing statements.
Individuals:** The techniques targeting consumers—impersonation, urgency, trust exploitation—will get harder to detect as AI tools lower the barrier to polished, personalized attacks.
Bottom Line
IdentityIQ's 2021 reading list reads like a catalog of evergreen threats. Fake shopping sites, credential theft, social engineering, ransomware at third-party vendors—these aren't fading away. They're the baseline. For security professionals, the practical question isn't whether to address these threats, but whether your monitoring and response capabilities extend beyond the perimeter to cover the personal attack surface your organization carries.
What to Watch Next
Expect account takeover tooling to keep evolving as defenders close obvious gaps. Watch for ransomware groups to target more managed service providers and software supply chains, creating downstream victims who assume their vendors are secure. And keep an eye on AI-assisted phishing—the same principles IdentityIQ's readers were warned about in 2021 will get harder to detect as tools lower the barrier to polished, personalized attacks.
Key takeaways
- Top-read security topics reveal which threats actually succeed at scale; treat this as signal, not noise
- Supply chain incidents create victims who never directly interacted with the attacker—third-party risk monitoring matters personally and professionally
- Account takeover remains underprioritized relative to its prevalence; audit authentication paths, especially recovery flows and legacy integrations
- Personal and corporate threat surfaces are converging; what your team members face at home can become your organization's problem via credential reuse
Frequently asked questions
Why do identity protection services track popular scam topics?
These services monitor which threats are generating the most customer inquiries and fraud alerts, which signals which attack patterns are actually succeeding at scale—not just theoretical risks.
Is the threat landscape actually the same as it was in 2021?
Many core techniques persist because they remain profitable. Attackers invest in what works, and defenders haven't universally closed the gaps that enable fake shopping sites, credential theft, and social engineering.
How does a hospital data breach differ from a retail breach?
Healthcare records include medical history, insurance details, and Social Security numbers—creating multiple fraud vectors. Hospital systems also often run legacy software, making them harder to patch and more attractive to ransomware operators.
What does "account takeover" mean for corporate security?
When attackers compromise an existing account with permissions (email, cloud services, admin panels), they bypass the need to breach the perimeter directly. This makes MFA and monitoring for anomalous authentication patterns critical.
Should I recommend identity protection services to my organization's employees?
Personal identity monitoring can reduce the blast radius of breaches that involve employee data. This indirectly protects corporate systems by reducing the pool of reused credentials attackers could use for phishing or credential stuffing.