Sleep Deprivation Increases Vulnerability to Phishing Attacks
Losing an hour of sleep during Daylight Saving Time makes individuals more impulsive and susceptible to scams.
1Daylight Saving Time Impact
The transition to Daylight Saving Time in March forces people to lose an hour of sleep. This annual shift is a well-established source of mild sleep deprivation for the general population. Beyond physical fatigue, researchers are now uncovering how this specific loss of rest affects cognitive functions and daily decision-making processes.
2Phishing Vulnerability Study
A study published in the Proceedings of the National Academy of Sciences analyzed over 10,000 participants. Researchers sent spoofed phishing emails to employees at the University of California, Irvine. By comparing responses before and after the time change, they measured how sleep loss directly influences the likelihood of clicking suspicious links.
3Increased Click-Through Rates
The data revealed that individuals were 13% more likely to click on links within suspicious messages the Monday after the time change. While the shift did not change how often people opened emails or reported them as spam, it significantly increased the probability of users engaging with potentially malicious web content.
4Cognitive Impairment Mechanism
Sleep loss renders individuals more impulsive and less capable of careful deliberation. According to study author Eitan Schechtman, participants lacked the full mental capacity to critically examine whether an email was deceptive. This cognitive state makes it easier for attackers to compromise security through fake websites or fraudulent data collection attempts.
5External Expert Perspectives
Jason R.C. Nurse, a professor at the University of Kent, notes that various factors like stress and workload influence scam susceptibility. He emphasizes that sleep deprivation fits this profile by directly impacting our state of mind. When we fail to think rationally about our inboxes, we become significantly more vulnerable to attacks.
6Fall Transition Uncertainties
When clocks fall back in November, people theoretically gain an extra hour of sleep. However, Schechtman suspects this does not necessarily reduce phishing susceptibility. People rarely use the extra hour for sleep, often choosing to stay awake longer instead. Previous studies suggest the sleep gain in autumn is less than the spring loss.
7Secret Data Collection
To ensure authentic results, Schechtman kept the study secret from his colleagues and students. He delayed publication to collect data during the most recent time transition. Because the research is now public knowledge, he believes he cannot replicate this specific study design at his own institution again in the future.
8Future Research Implications
Schechtman hopes other institutions will replicate these findings to confirm the link between sleep and cybersecurity behavior. Understanding this connection is vital for organizational security strategies. As digital threats evolve, recognizing that human cognitive states are a primary security variable remains essential for protecting sensitive data from sophisticated phishing attempts.
Original article: TIME — Sleep Deprivation Increases Vulnerability to Phishing Attacks