In 42.9% of cases prior to 2019, breaches were first flagged by outside parties such as security firms, regulators, or customers.