Sleep Loss Raises Employee Phishing Click Rates
A UC Irvine study found one hour of lost sleep from Daylight Saving Time made employees 13% more likely to click simulated phishing links.
Updated on Nov. 10, 2026 in Sleep Disorders
Live Poll
Do you think losing sleep makes you more likely to fall for online scams?
Researchers at UC Irvine found that employees at a large U.S. institution were 13% more likely to click simulated phishing emails on the Monday after the spring 2026 Daylight Saving Time transition. The click rate rose from 15.56% the previous Monday to 17.76% after the time change.
Why it matters
Nearly one-third of U.S. adults already fail to get enough sleep, and the study links that shortfall to weaker security decisions at work. With estimated U.S. cybercrime losses exceeding $20 billion in 2025, even small drops in employee vigilance carry real financial stakes.
The study compared simulated phishing click rates across more than 11,000 employees before and after the spring 2026 time change, finding a rise from 15.56% to 17.76%. The data does not show how long the effect lasts or whether it carries over to real-world attacks.
The players
University of California, Irvine
A public research university in Irvine, California, whose researchers conducted the study on sleep loss and phishing susceptibility.
Proceedings of the National Academy of Sciences
A peer-reviewed scientific journal published by the U.S. National Academy of Sciences, where the findings appeared.
The details
The researchers used a cybersecurity awareness campaign run by the institution's information technology group, which sends simulated phishing emails every few months. Separately, the U.S. House of Representatives passed the Sunshine Protection Act, which would make Daylight Saving Time permanent throughout the country. The findings were published in the Proceedings of the National Academy of Sciences.
Timeline
Spring 2026: The Daylight Saving Time transition reduced sleep by up to one hour.
The Monday after the transition: Employee phishing click rate rose to 17.76%.
2025: U.S. cybercrime losses were estimated to exceed $20 billion.
November 9, 2026: UC Irvine reported the study findings.
Legislative Context
The U.S. House of Representatives passed the Sunshine Protection Act, which would end the twice-yearly clock change by making Daylight Saving Time permanent nationwide. The UC Irvine findings add a workplace cybersecurity dimension to the ongoing national debate over the clock-change schedule.
Employees who are short on sleep after a clock change may be more likely to overlook suspicious emails, so extra caution with links and attachments in the days after the transition is worthwhile. Employers may also consider reminding staff about phishing risks around Daylight Saving Time shifts.
The takeaway
Protecting sleep is also a security measure: even a single lost hour can measurably weaken judgment at work. Staying alert to suspicious links during the week after a time change is a simple habit that reduces risk.
Further reading
Explore more on Sleep Disorders to see how lost sleep affects daily performance.
Live Poll
Do you think losing sleep makes you more likely to fall for online scams?
