Good numbers industry-wide are difficult to come by (but getting better), but according to the latest DBIR‡ (which, full disclosure, is put out by my former employer) breaks it down as 98% external, and 4% internal (why that adds up to greater than 100% is a mystery to me).
‡ http://www.verizonbusiness.com/resources/reports/rp_data-bre...