It is a curious property of the universe that as Americans grew increasingly willing to spend their money at a warehouse club for industrial quantities of cheese, criminals grew proportionally more enthusiastic about trying to steal those credentials online. One would think these phenomena lived in entirely separate dimensions of human experience, yet here they are, rising in tandem like two dancers who have never met but somehow learned the same routine. Between 2010 and 2022, Costco's revenue and global phishing attacks achieved a correlation coefficient of 0.975, which is the sort of number that makes statisticians simultaneously excited and deeply uncomfortable.
The real culprit here is almost certainly the internet itself, that vast democratising engine that has made both bulk retail and large-scale fraud exponentially more accessible to anyone with a browser. As more people went online to do legitimate shopping, more people also went online to do illegitimate shopping, which is to say stealing other people's credentials and emptying their accounts—a kind of dark mirror image of commerce, scaling at roughly the same pace. Between 2010 and 2022, global internet users grew from roughly 2 billion to 4.6 billion, an expansion so vast it's like the entire population of the planet suddenly appeared at the door of every possible institution, legitimate and criminal alike.
What we are witnessing, then, is not a causal relationship between bulk warehouse membership and cybercrime, but rather two entirely separate human enterprises both riding the enormous wave of global connectivity. This ought to be reassuring, except it isn't, because it means that for every new technological convenience we embrace, we are simultaneously embracing the infrastructure that makes stealing from each other vastly more efficient. The lesson, if there is one, is that correlation remains humanity's most reliable tool for seeing what we hope to see.
As an Amazon Associate, getspurious.com earns from qualifying purchases. Learn more.
Want to learn more about why correlations like “Costco annual revenue” vs “Phishing attacks reported annually (worldwide)” don't prove causation? Read our guide to statistical thinking.