Another data point referenced in InfoSec circles is the "Verizon Data Breach Investigations Report"

https://www.verizon.com/business/resources/reports/dbir/