Employees were more likely to click simulated phishing links on the Monday after the spring clock change: about 17.7% clicked, compared with roughly 15.5% the Monday before. The source reports an increase of approximately 13%, linking it to the roughly one hour of sleep people can lose when daylight saving time begins.
That’s a warning about timing, not proof that losing an hour of sleep causes someone to fall for a phishing email. Researchers didn’t directly measure employees’ sleep. Instead, they compared clicking behavior around the clock change using results from a real-world cybersecurity awareness campaign.
As reported by Popsci, neurobiologists at the University of California, Irvine published the research in Proceedings of the National Academy of Sciences (PNAS). Their question was straightforward: could even a small reduction in someone’s usual amount of sleep make them more vulnerable to phishing? The findings suggest that modest sleep disruption may be associated with more impulsive decisions.
The team worked with an unnamed large company on a cybersecurity awareness campaign involving more than 11,000 employees. Several times a year, the company’s IT department sent emails imitating phishing attempts, then counted how many employees clicked the simulated malicious links. These were tests, so the clicks didn’t establish that employees had become victims of actual online fraud.
Schechtman’s team analyzed results from before the switch to daylight saving time and from the Monday immediately after the lost hour. The rise from approximately 15.5% to 17.7% amounts to 2.2 percentage points. The source’s reported relative increase of about 13% doesn’t precisely match those rounded rates, but both describe a rise in clicks after the clock change.
The source describes the finding more broadly as a greater-than-10% increase in the likelihood of falling for some form of online scam the next morning after losing an hour of sleep. The evidence here is narrower: employees clicked simulated phishing links around a time change. The study didn’t directly test every kind of scam or measure each participant’s sleep loss.
Insufficient sleep can affect mood and energy and may have harmful long-term health consequences. The researchers suspect it could also impair many other everyday decisions, although this study focused on cybersecurity.
For organizations, the practical question is when employees face these tests and threats. Periods of disrupted sleep may deserve consideration when planning security awareness campaigns and defenses, rather than treating every Monday as an equivalent test of employees’ judgment.
