A University of California, Irvine study finds that losing just one hour of sleep may increase susceptibility to phishing attacks, raising concerns about cybersecurity and fatigue.
Webdesk-Amina Houth
Losing just one hour of sleep could make people more vulnerable to phishing attacks, according to a new study by researchers at the University of California, Irvine, highlighting the overlooked connection between fatigue and cybersecurity risks.
Published in the Proceedings of the National Academy of Sciences (PNAS), the research examined employee responses to simulated phishing emails before and after the annual daylight saving time transition, when clocks are moved forward by one hour.
Researchers analyzed cybersecurity awareness campaign data involving more than 11,000 employees at a large US institution. The organization regularly sends simulated phishing emails to employees to assess their awareness of suspicious messages and monitor whether they click potentially malicious links.
The findings showed that the phishing click rate increased from 15.56 percent on the Monday before the daylight saving time change to 17.76 percent on the Monday immediately afterward. This represented an approximately 13 percent increase in the odds of employees clicking on simulated malicious links.
The study’s findings are particularly significant because they examined the effects of a relatively minor sleep disruption rather than prolonged sleep deprivation.
Eitan Schechtman, the study’s lead researcher and assistant professor of neurobiology and behavior at UC Irvine, said the results suggest that even limited sleep loss can influence everyday decision-making.
Researchers believe fatigue may encourage impulsive decisions and reduce people’s ability to carefully evaluate suspicious messages, making them more likely to fall for phishing attempts.
The findings also raise concerns for businesses, where a single careless click can expose sensitive information or create opportunities for cybercriminals. According to the FBI’s Internet Crime Complaint Center, reported cybercrime losses in the United States exceeded $20 billion in 2025.
Schechtman urged employers and cybersecurity organizations to remain particularly vigilant during daylight saving time transitions and other periods associated with sleep disruption, including holidays and major sporting events.
The researchers also highlighted the wider debate surrounding daylight saving time, noting that permanent standard time is more closely aligned with the body’s natural internal clock.
While adequate sleep alone cannot prevent phishing attacks, the study highlights how human behaviour and fatigue can influence digital security. Researchers advise users to remain cautious with unexpected emails and avoid clicking suspicious links, particularly when tired.
