In fact, nowadays it's easier for some companies to say they were the victims of an advanced persistent threat (APT) attacks than to admit that their security systems failed, said Bryan Sartin, Verizon's director of investigative response. "It's out there," he said of the APT. "It's just so extremely overhyped."

Sartin, whose team gets called in to find the cause of data breaches, says that he's seen a tendency to label any hacking incident an APT attack play out several times since Google went public with the issue in January last year. Usually it happens about a month or two after his team finishes its analysis. "I get a link sent to me from one of my investigators saying, 'You're not going to believe this.' I open the link and get a statement from the company blaming advanced persistent threat."

Advanced persistent threat attacks are supposed to be sophisticated and highly targeted data exfiltration exercises conducted by spies or agents working on behalf of nation states.

Blaming APT has "become the perfect excuse" for companies recovering from a data breach, Sartin said. "It's almost as if it's become chic in the U.S. to blame it [on APT]," he said.

Part of the problem is confusion over China, the country most commonly associated with APT attacks. China is the source for most online attacks these days, no matter what the motivation. The country has more than 400 million Internet users, and many of them are using computers that don't have up-to-date patches or security software. Those PCs often get hacked and then used as stepping-stones for further attacks.