Sleep Deprivation Increases Vulnerability to Phishing Attacks
Minor sleep loss significantly raises the likelihood of employees clicking on malicious phishing links.
1Sleep Loss and Security
Researchers at the University of California, Irvine, discovered that even minor sleep deprivation increases the likelihood of individuals clicking on phishing links. The study, published in the Proceedings of the National Academy of Sciences, highlights how fatigue impairs cognitive functions, making people more susceptible to deceptive digital communications and scams.
2Daylight Saving Time Impact
The study analyzed employee behavior during the daylight saving time transition, where clocks shift forward by one hour. By comparing phishing click rates before and after this change, researchers observed a 13 percent relative increase in the odds of employees interacting with simulated malicious emails, demonstrating a clear link between rest and vigilance.
3Data from Corporate Trials
The research utilized data from a cybersecurity awareness campaign involving over 11,000 employees at a large US institution. The organization regularly sends simulated phishing emails to staff members to test security protocols. Results showed click rates rose from 15.56 percent to 17.76 percent immediately following the one-hour time change event.
4Impulsive Decision-Making Mechanism
Lead researcher Eitan Schechtman notes that sleep loss fosters impulsive decision-making, which reduces caution when evaluating suspicious messages. This cognitive shift suggests that fatigue does not just affect physical performance but also degrades the quality of everyday digital choices, potentially leading to avoidable security breaches within both personal and professional environments.
5Financial Consequences of Fatigue
The implications of these findings extend beyond individual inboxes to broader economic impacts. With US cybercrime losses exceeding $20 billion in 2025 according to the FBI, even moderate increases in susceptibility to phishing can result in significant financial damage for businesses, emphasizing that human error remains a critical, often overlooked security factor.
6Policy and Clock Changes
The findings raise questions regarding the twice-yearly changing of clocks in the United States. While permanent daylight saving time could eliminate this specific transition, researchers noted that standard time aligns better with the body's internal clock. This suggests that public policy decisions regarding timekeeping may have unintended consequences for national cybersecurity posture.
7Recommendations for Employers
Eitan Schechtman urges employers and cybersecurity firms to remain vigilant during periods likely to cause sleep loss, such as holidays, major sporting events, or time changes. Organizations should implement heightened security awareness during these windows, acknowledging that their workforce may be temporarily more vulnerable to sophisticated social engineering and phishing attempts.
8Individual Security Takeaway
The primary takeaway for users is that tiredness directly influences the ability to critically review questionable emails. While better sleep is not a complete solution for digital security, it is a vital component of personal protection. Users are advised to avoid clicking unexpected links, especially after experiencing a poor night of sleep.
Original article: Digital Trends — Sleep Deprivation Increases Vulnerability to Phishing Attacks