As far as I know the most successful attacks on companies were based on very simple techniques like phishing or similar easy techniques like SQL-Injection. When

As far as I know the most successful attacks on companies were based on very simple techniques like phishing or similar easy techniques like SQL-Injection. When we talk about data breaches of companies, it mostly hasn't something to do with high sophisticated attacks using 0-days I guess. I'm not sure, would you agree? Of course companies tell you that there were victims of high sophisticated APT attacks, otherwise they would have to admit, they had been compromised by simple script-kiddy attacks. Of course blaming victims doesn't help anyone. I want to emphasize here, that not only the companies are victims but also the users and customers, who mostly never received compensations after security failures.