Basic web application attacks: global most-targeted industries 2021-2022

The source adds the following information: "All incidents included in this report were reviewed and converted (if necessary) into the VERIS framework to create a common, anonymous aggregate data set.
The incident must have at least seven enumerations (e.g., threat actor variety, threat action category, variety of integrity loss, et al.) across 34 fields OR be a DDoS attack. Exceptions are given to confirmed data breaches with less than seven enumerations . The incident must have at least one known VERIS threat action category (hacking, malware, etc.).
We also exclude incidents and breaches affecting individuals that cannot be tied to an organizational attribute loss."