# Cybersecurity Statistics 2026: Cybercrime Losses, Attacks, Ransomware and Breaches

Updated 2026-10-19. Checked by StatisticsGlobal editorial team. FBI IC3 complaints, the UK Cyber Security Breaches Survey, ENISA, the Verizon DBIR and the CISA KEV catalogue, 5 primary sources, data for 2024 to 2026.
Canonical: https://statisticsglobal.org/cybersecurity-statistics/

Losses reported to the FBI Internet Crime Complaint Center reached $20.877 billion in 2025, up 26% on 2024, from just over a million complaints. Phishing is the most reported attack in the US, UK and EU sources. In the UK, 43% of businesses had a breach or attack in the 2025/2026 survey. Ransomware was present in 48% of the breaches in Verizon's 2026 report. Investment fraud and business email compromise cause the biggest losses.

## Key statistics

- Complainants reported $20.877 billion in losses to the FBI Internet Crime Complaint Center in 2025, according to the FBI Internet Crime Complaint Center.
- 43% of UK businesses, about 612,000, had a cyber breach or attack in the 12 months before the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology.
- Ransomware was present in 48% of breaches in the 2026 report, up from 44% the year before, according to Verizon.
- Business email compromise cost about $123,000 per complaint in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
- CISA added 264 vulnerabilities to its KEV catalogue in 2026 to 16 October, already 7.8% more than all of 2025, calculated by StatisticsGlobal from CISA data.

## Cybercrime losses by year (FBI IC3)

The FBI Internet Crime Complaint Center (IC3) publishes the longest public series on reported cybercrime. It counts complaints from victims and the losses they report. In 2025 it passed one million complaints for the first time.

Reported losses have risen every year since 2020. They reached $20.877 billion in 2025, almost five times the 2020 figure. The average loss was $20,699 per complaint. Most of the money is lost to fraud rather than to hacking. Cyber-enabled fraud made up 45% of complaints but 85% of losses.

Two groups stand out. Complaints that involved cryptocurrency reported $11.37 billion in losses, or 54.4% of the total. Cryptocurrency is a descriptor that overlaps other crime types, so this share includes much of the investment fraud below. People aged 60 and over reported $7.7 billion, about 36.9% of all losses, more than any other age group.

IC3 figures are a floor, not a total. They only count crimes that victims chose to report to IC3. Some victims report directly to FBI field offices or not at all, and the losses exclude lost business and recovery costs.

- Complainants reported $20.877 billion in losses to the FBI Internet Crime Complaint Center in 2025, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- The FBI Internet Crime Complaint Center received 1,008,597 complaints in 2025, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Losses reported to IC3 rose 26% in 2025, from $16.6 billion in 2024 to $20.877 billion, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Losses reported to IC3 in 2025 were almost five times the $4.2 billion reported in 2020, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- The average loss per complaint reported to IC3 was $20,699 in 2025, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Cyber-enabled fraud accounted for 85% of losses reported to IC3 in 2025, or $17.70 billion, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Complaints involving cryptocurrency reported $11.37 billion in losses in 2025, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Complaints involving cryptocurrency accounted for 54.4% of all losses reported to IC3 in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- People aged 60 and over filed 201,266 complaints reporting $7.7 billion in losses in 2025, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- People aged 60 and over accounted for about 36.9% of all losses reported to IC3 in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf

Table: Losses reported to the FBI Internet Crime Complaint Center by year, 2020 to 2025

| Year | Reported losses | Change on previous year |
|---|---|---|
| 2020 | $4.2 billion | - |
| 2021 | $6.9 billion | +64.3% |
| 2022 | $10.3 billion | +49.3% |
| 2023 | $12.5 billion | +21.4% |
| 2024 | $16.6 billion | +32.8% |
| 2025 | $20.877 billion | +25.8% |

Source: FBI IC3 2025 Internet Crime Report, chart "Losses by Year". Year-on-year changes calculated by StatisticsGlobal from the rounded yearly totals. IC3 states the 2025 rise as 26%.

## Most common types of cyber attack

The most common attack is not the most costly one. Phishing tops the IC3 complaint count. Investment fraud and business email compromise cause most of the losses.

Phishing and spoofing produced 191,561 complaints in 2025, 19.0% of the total. But each complaint reported only about $1,127 in losses. Business email compromise cost about $123,000 per complaint and investment fraud about $118,500.

Phishing complaints are falling. They dropped 35.9% between 2023 and 2025. Investment fraud moved the other way, with losses up 31.6% in 2025. Government impersonation complaints rose 86.7%. IC3 also logged 22,364 AI-related complaints, with $893 million in losses.

For breaches of organisations, the entry point is shifting. Verizon found vulnerability exploitation was the top initial access vector in its 2026 report, at 31% of breaches. Credential abuse fell to 13% and phishing stayed at 16%. A human element was still present in 62% of breaches.

- Phishing and spoofing was the most reported crime type in 2025, with 191,561 complaints, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Phishing and spoofing made up 19.0% of all complaints to IC3 in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Phishing and spoofing complaints reported about $1,127 in losses each in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Phishing and spoofing complaints to IC3 fell 35.9% between 2023 and 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Investment fraud caused the largest losses reported to IC3 in 2025, at $8.65 billion from 72,984 complaints, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Investment fraud cost about $118,500 per complaint in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Reported investment fraud losses rose 31.6% in 2025, to $8.65 billion from $6.57 billion in 2024, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Business email compromise caused $3.05 billion in reported losses in 2025 from 24,768 complaints, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Business email compromise cost about $123,000 per complaint in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Government impersonation complaints rose 86.7% in 2025, from 17,367 to 32,424, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- IC3 logged 22,364 AI-related complaints with $893 million in losses in 2025, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Vulnerability exploitation was the top initial access vector at 31% of breaches in the 2026 report, ahead of credential abuse at 13%, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- A human element was present in 62% of breaches in the 2026 report, up from 60%, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf

Table: Largest crime types by reported loss, FBI IC3, 2025, with loss per complaint

| Crime type | Complaints | Reported losses | Loss per complaint |
|---|---|---|---|
| Investment fraud | 72,984 | $8.65 billion | $118,500 |
| Business email compromise | 24,768 | $3.05 billion | $123,005 |
| Tech and customer support scams | 47,794 | $2.13 billion | $44,664 |
| Personal data breach | 67,456 | $1.31 billion | $19,493 |
| Confidence and romance scams | 23,159 | $929 million | $40,126 |
| Government impersonation | 32,424 | $798 million | $24,610 |
| Phishing and spoofing | 191,561 | $216 million | $1,127 |
| Extortion | 89,129 | $122 million | $1,374 |
| Ransomware | 3,611 | $32.3 million | $8,950 |

Source: FBI IC3 2025 Internet Crime Report, crime types by complaint count and by loss. Loss per complaint calculated by StatisticsGlobal. Losses rounded.

## Cyber attack statistics in the US, UK and EU

Each region has a different main source. The US has victim complaints, the UK has a survey of organisations and the EU has ENISA's curated incident dataset. Phishing leads in all three.

In the UK, 43% of businesses and 28% of charities had a breach or attack in the 12 months before interview. That is about 612,000 businesses. The rate was the same as the previous survey. Larger firms report far more attacks. 69% of large businesses had one, against 42% of micro businesses, a gap of 27 points.

Phishing hit 38% of UK businesses, the most common attack by far. 19% of businesses were victims of cyber crime, about 267,000 firms. They faced about 5.19 million crimes between them, or about 19 each. Protection is patchy. 47% had some cyber insurance and 31% had a board member responsible for cyber security.

In the EU, ENISA analysed 4,875 incidents from July 2024 to June 2025. DDoS attacks made up about 76.7% of them, mostly by hacktivists, and had low impact. Among intrusion vectors, phishing accounted for about 60% and vulnerability exploitation 21.3%.

The phishing figures in the table are not comparable. One counts complaints, one counts businesses, one counts intrusion vectors and one counts breaches. They agree on the ranking, not the size.

- 43% of UK businesses, about 612,000, had a cyber breach or attack in the 12 months before the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- 28% of UK charities, about 57,000, had a cyber breach or attack in the 12 months before the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- 69% of large UK businesses and 65% of medium businesses had a breach or attack in the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- Large UK businesses were 27 percentage points more likely than micro businesses to report a breach or attack in the 2025/2026 survey, calculated by StatisticsGlobal from UK Department for Science, Innovation and Technology data. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- Phishing hit 38% of UK businesses and 25% of charities in the 2025/2026 survey, the most common attack by far, according to the UK Department for Science, Innovation and Technology. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- 19% of UK businesses, about 267,000, were victims of cyber crime in the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- UK businesses experienced about 5.19 million cyber crimes in the 12 months covered by the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- UK businesses hit by cyber crime suffered about 19 crimes each on average in the 2025/2026 survey, calculated by StatisticsGlobal from UK Department for Science, Innovation and Technology data. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- 47% of UK businesses and 35% of charities were insured against cyber risks in some way in the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- 31% of UK businesses had board members with explicit responsibility for cyber security in the 2025/2026 survey, up from 27%, according to the UK Department for Science, Innovation and Technology. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- ENISA analysed 4,875 cyber incidents affecting the EU between July 2024 and June 2025, according to ENISA. Source: ENISA, ENISA Threat Landscape 2025 (version 1.3) (1 October 2025, revised 22 September 2026, accessed 19 October 2026) https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202025_v1.3_September2026_0.pdf
- Phishing accounted for about 60% of observed intrusion vectors in the EU in the year to June 2025, according to ENISA. Source: ENISA, ENISA Threat Landscape 2025 (version 1.3) (1 October 2025, revised 22 September 2026, accessed 19 October 2026) https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202025_v1.3_September2026_0.pdf
- Vulnerability exploitation accounted for 21.3% of observed intrusion vectors in the EU in the year to June 2025, according to ENISA. Source: ENISA, ENISA Threat Landscape 2025 (version 1.3) (1 October 2025, revised 22 September 2026, accessed 19 October 2026) https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202025_v1.3_September2026_0.pdf
- DDoS attacks made up about 76.7% of incidents recorded in the EU in the year to June 2025, mostly by hacktivists, according to ENISA. Source: ENISA, ENISA Threat Landscape 2025 (version 1.3) (1 October 2025, revised 22 September 2026, accessed 19 October 2026) https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202025_v1.3_September2026_0.pdf

Table: How each source measures phishing, US, UK, EU and worldwide

| Source | Scope | Phishing figure | What it measures |
|---|---|---|---|
| FBI IC3 (2025) | United States | 19.0% | Share of all complaints filed |
| UK Cyber Security Breaches Survey (2025/2026) | United Kingdom | 38% | Share of businesses hit by phishing in 12 months |
| ENISA Threat Landscape (year to June 2025) | European Union | About 60% | Share of observed intrusion vectors |
| Verizon DBIR (2026) | Worldwide | 16% | Share of breaches where phishing was the initial access vector |

Sources: FBI IC3 2025 report (share calculated by StatisticsGlobal from 191,561 of 1,008,597 complaints); UK DSIT, 30 April 2026; ENISA Threat Landscape 2025 v1.3; Verizon 2026 DBIR Executive Summary.

## Ransomware statistics

Ransomware is the most damaging threat for organisations, but it looks very different by source. It is rare in victim complaints and surveys and common in breach investigations.

Verizon found ransomware in 48% of breaches in its 2026 report, up from 44%. Yet fewer victims pay. 69% did not pay, and the median payment fell 6.8% to $139,875. Verizon says small organisations are hit disproportionately.

IC3 received 3,611 ransomware complaints in 2025, up 14.4%. Reported losses rose 159% to $32.3 million. IC3 warns this loss figure is artificially low. It leaves out downtime and recovery costs, and some victims report no loss at all.

The UK survey shows ransomware at 1% of businesses, down from 3%. The sources do agree on one name. Akira was the most reported variant to IC3 in 2025 and the most deployed in the EU, at 11.6% of ENISA's cases.

- Ransomware was present in 48% of breaches in the 2026 report, up from 44% the year before, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- 69% of ransomware victims did not pay, and the median ransom paid was $139,875, in the 2026 report, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- The median ransom paid fell 6.8% in the 2026 report, from $150,000 to $139,875, calculated by StatisticsGlobal from Verizon data. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- IC3 received 3,611 ransomware complaints in 2025, with reported losses of $32.3 million, according to the FBI Internet Crime Complaint Center. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- Ransomware complaints to IC3 rose 14.4% in 2025 while reported ransomware losses rose 159%, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data. Source: FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report (2026, accessed 19 October 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
- 1% of UK businesses reported ransomware in the 2025/2026 survey, down from 3% in each of the two previous surveys, according to the UK Department for Science, Innovation and Technology. Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026 (30 April 2026, accessed 19 October 2026) https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- 82 ransomware variants were deployed against EU organisations in the year to June 2025, with Akira the most frequent at 11.6%, according to ENISA. Source: ENISA, ENISA Threat Landscape 2025 (version 1.3) (1 October 2025, revised 22 September 2026, accessed 19 October 2026) https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202025_v1.3_September2026_0.pdf
- 20.7% of vulnerabilities in the CISA KEV catalogue were known to be used in ransomware campaigns in October 2026, calculated by StatisticsGlobal from CISA data. Source: CISA, Known Exploited Vulnerabilities Catalog (catalog version 2026.10.16) (16 October 2026, accessed 19 October 2026) https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Table: Ransomware figures by source, latest available

| Source | Scope and period | Ransomware figure |
|---|---|---|
| Verizon DBIR (2026) | Worldwide, October 2024 to November 2025 | In 48% of breaches (44% a year earlier). 69% of victims did not pay. Median ransom paid $139,875 |
| FBI IC3 (2025) | United States, 2025 | 3,611 complaints, $32.3 million reported losses |
| UK Cyber Security Breaches Survey (2025/2026) | United Kingdom, 12 months to late 2025 | 1% of businesses (3% in each of the two previous surveys) |
| ENISA Threat Landscape (2025) | European Union, July 2024 to June 2025 | 82 variants deployed. Akira most frequent at 11.6% |
| CISA KEV catalogue (October 2026) | Worldwide, catalogue to 16 October 2026 | 361 of 1,748 exploited vulnerabilities (20.7%) known to be used by ransomware |

Sources: Verizon 2026 DBIR Executive Summary; FBI IC3 2025 report; UK DSIT, 30 April 2026; ENISA Threat Landscape 2025 v1.3; CISA KEV catalog version 2026.10.16 (share calculated by StatisticsGlobal).

## Cybersecurity statistics by industry

Verizon breaks down incidents and confirmed breaches by industry. ENISA ranks EU sectors by incident share. IC3 names the critical sectors most hit by ransomware.

Industries differ in how often an incident becomes a breach. In Verizon's 2026 data, 96.4% of healthcare incidents and 96.2% of education incidents were confirmed breaches. In finance only 34.1% were, so most finance incidents did not lead to confirmed data disclosure. For hospital AI and health data trends, see our [AI in healthcare statistics](https://statisticsglobal.org/ai-in-healthcare-statistics/) page.

In the EU, public administration takes 38.2% of incidents with a known sector, far ahead of transport at 7.5%. ENISA says hacktivists and state-aligned groups focus on it. In the US, IC3 says the top ransomware variants hit critical manufacturing, healthcare and government facilities most. Outside critical sectors, legal services made up 18% of ransomware complaints.

Shared suppliers spread risk across industries. Third parties were involved in 48% of breaches in Verizon's 2026 report. Verizon found only 23% of third-party organisations fully fixed missing or weak MFA on their cloud accounts. For the providers behind that cloud exposure, see our [cloud market share](https://statisticsglobal.org/cloud-market-share/) page. Unpatched software is the other common thread. CISA listed 1,748 known exploited vulnerabilities on 16 October 2026, and 264 were added in 2026, already more than the 245 added in all of 2025. Microsoft products account for 22.3% of the catalogue. Verizon found only 26% of these vulnerabilities were fully fixed in 2025.

- Verizon analysed more than 31,000 incidents and more than 22,000 confirmed data breaches for its 2026 report, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- 96.4% of healthcare incidents in the 2026 report were confirmed breaches, against 34.1% in finance, calculated by StatisticsGlobal from Verizon data. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- Third parties were involved in 48% of breaches in the 2026 report, up 60% on the year before, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
- Public administration was the most targeted EU sector in the year to June 2025, with 38.2% of sector-attributed incidents, according to ENISA. Source: ENISA, ENISA Threat Landscape 2025 (version 1.3) (1 October 2025, revised 22 September 2026, accessed 19 October 2026) https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202025_v1.3_September2026_0.pdf
- CISA listed 1,748 known exploited vulnerabilities in its catalogue on 16 October 2026, counted by StatisticsGlobal from CISA data. Source: CISA, Known Exploited Vulnerabilities Catalog (catalog version 2026.10.16) (16 October 2026, accessed 19 October 2026) https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA added 264 vulnerabilities to its KEV catalogue in 2026 to 16 October, already 7.8% more than all of 2025, calculated by StatisticsGlobal from CISA data. Source: CISA, Known Exploited Vulnerabilities Catalog (catalog version 2026.10.16) (16 October 2026, accessed 19 October 2026) https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Microsoft products account for 390 of 1,748 entries, or 22.3%, in the CISA KEV catalogue in 2026, calculated by StatisticsGlobal from CISA data. Source: CISA, Known Exploited Vulnerabilities Catalog (catalog version 2026.10.16) (16 October 2026, accessed 19 October 2026) https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Only 26% of CISA KEV vulnerabilities were fully remediated by organisations in 2025, down from 38%, according to Verizon. Source: Verizon, 2026 Data Breach Investigations Report, Executive Summary (2026, accessed 19 October 2026) https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf

Table: Security incidents and confirmed data breaches by industry, Verizon DBIR 2026

| Industry | Incidents | Confirmed breaches | Share confirmed as breaches |
|---|---|---|---|
| Financial and insurance | 3,809 | 1,300 | 34.1% |
| Public administration | 3,634 | 2,410 | 66.3% |
| Manufacturing | 3,627 | 2,713 | 74.8% |
| Healthcare | 1,492 | 1,438 | 96.4% |
| Educational services | 1,302 | 1,252 | 96.2% |
| Retail | 997 | 806 | 80.8% |

Source: Verizon 2026 DBIR Executive Summary, industry sections. Share confirmed as breaches calculated by StatisticsGlobal. Counts depend on what contributors share with Verizon, not on how often each industry is attacked.

## How the sources measure cybersecurity

FBI IC3 counts complaints filed by victims, mostly in the US, and the losses they report. It does not count unreported crime, and losses exclude lost business and recovery costs. Crime types overlap, and descriptors such as cryptocurrency and AI cut across them. The yearly loss series comes from a chart in the 2025 report.

The UK Cyber Security Breaches Survey is an Ipsos survey of 2,112 businesses and 1,085 charities, with fieldwork from August to December 2025. It asks about the 12 months before interview. Costs are the cost as perceived by respondents.

ENISA analyses 4,875 incidents it selected and curated from open sources, from July 2024 to June 2025. ENISA notes that hacktivist DDoS dominates the count but has very low impact. ENISA revised the report to version 1.3 in September 2026 to correct figures. We use version 1.3.

Verizon's DBIR uses incidents shared by Verizon and partner organisations, worldwide, from October 2024 to November 2025. It is large but not a random sample. Industry counts reflect who contributes data. We use the free executive summary.

The CISA Known Exploited Vulnerabilities catalogue lists flaws with evidence of active exploitation. Its first entries are dated 3 November 2021, so the 2021 count includes older flaws added at launch. We counted entries from catalog version 2026.10.16 and keep a [snapshot of the data](https://statisticsglobal.org/data/snapshots/cisa/kev-catalog-2026-10-16.csv).


## Frequently asked questions

### How much did cybercrime cost in 2025?

Victims reported $20.877 billion in losses to the FBI Internet Crime Complaint Center in 2025, up 26% from $16.6 billion in 2024. This counts only reported crime, so the true cost is higher.

### What is the most common type of cyber attack?

Phishing. It was the most reported crime type to the FBI in 2025, with 191,561 complaints. It hit 38% of UK businesses in the 2025/2026 survey and accounted for about 60% of intrusion vectors in ENISA's EU data.

### How many UK businesses had a cyber attack?

43% of UK businesses, about 612,000, had a breach or attack in the 12 months before the 2025/2026 Cyber Security Breaches Survey. The figure was 69% for large businesses and 28% for charities.

### Is ransomware increasing?

In breach data, yes. Verizon found ransomware in 48% of breaches in its 2026 report, up from 44%. IC3 ransomware complaints rose 14.4% in 2025. But fewer victims pay, 69% in Verizon's data, and the median ransom fell to $139,875.

### How has cybercrime changed compared with last year?

Reported losses to IC3 rose 26% in 2025. Investment fraud losses rose 31.6% and government impersonation complaints 86.7%. Phishing complaints fell slightly. CISA has already added more exploited vulnerabilities in 2026 than in all of 2025.

### Is there a forecast for cybercrime in 2026?

None of these primary sources publishes a forecast. IC3 losses have risen every year since 2020, and CISA's 2026 additions already exceed 2025. We will update this page when IC3 publishes its 2026 report.

## Sources

1. FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report, 2026, accessed 19 October 2026. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
2. UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026, 30 April 2026, accessed 19 October 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
3. Verizon, 2026 Data Breach Investigations Report, Executive Summary, 2026, accessed 19 October 2026. https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf
4. CISA, Known Exploited Vulnerabilities Catalog (catalog version 2026.10.16), 16 October 2026, accessed 19 October 2026. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. ENISA, ENISA Threat Landscape 2025 (version 1.3), 1 October 2025, revised 22 September 2026, accessed 19 October 2026. https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202025_v1.3_September2026_0.pdf