UC Irvine: clicks on simulated phishing links rose 13% on the Monday after the spring clock change

Neuroscientists at the University of California, Irvine, report that employees clicked links in simulated phishing emails more often after the spring switch to daylight saving time, according to ua.news. On the Monday after the clock change, the click rate was 13% higher than on the previous Monday ua.newsua.newsua.newsOpen source ↗. The results were published in Proceedings of the National Academy of Sciences.

Data from a workplace campaign

The researchers analyzed results of a cybersecurity awareness campaign covering more than 11,000 employees at a large institution in the United States. Its IT group sends phishing-like emails every few months to check how many recipients click the links in them.

On the Monday after the spring transition, when people may lose up to an hour of sleep, 17.76% of employees clicked the link. On the previous Monday, the share was 15.56%.

Interpretation by the authors

The authors believe that even a brief acute reduction in sleep may affect decision-making in everyday situations ua.newsua.newsua.newsOpen source ↗. Study leader Eitan Schechtman, an associate professor in the Department of Neurobiology and Behavior at the University of California, Irvine, noted that the consequences of sleep deprivation may not be limited to cybersecurity and may affect other daily decisions.

The researchers also linked the results to the debate over seasonal clock changes in the United States. According to them, permanent standard time aligns better with the internal biological clock than permanent daylight saving time. They urged employers and cybersecurity companies to consider risks during periods when employees' sleep may be disrupted, including after holidays or major sporting events.