Sources Of Data Breach

Every week/day in the news there is a new attack on individuals or businesses data (emails, credit card information, social security numbers, etc…). These attacks all get categorized as cyber-attacks, but what is the actual source of the attack? Is it malware? A skilled hacker(s)? Social engineering? Outdated software? I want to know what is the actual cause of data being stolen.

Have there been any studies done on this? I have seen studies on the overall cost of a data breach, and why you should protect yourself. I have read articles listing all the different ways you can be attached. But if I wanted to put in measures to protect myself or my company, where should I put the most effort? What are the most common ways for these attacks to occur. And if I run a business, what should I be teaching my employees to look out for?