Cybersecurity Statistics 2026: Cybercrime Losses, Attacks, Ransomware and Breaches
Losses reported to the FBI Internet Crime Complaint Center reached $20.877 billion in 2025, up 26% on 2024, from just over a million complaints. Phishing is the most reported attack in the US, UK and EU sources. In the UK, 43% of businesses had a breach or attack in the 2025/2026 survey. Ransomware was present in 48% of the breaches in Verizon's 2026 report. Investment fraud and business email compromise cause the biggest losses.
Key statistics
- Complainants reported $20.877 billion in losses to the FBI Internet Crime Complaint Center in 2025, according to the FBI Internet Crime Complaint Center.
- 43% of UK businesses, about 612,000, had a cyber breach or attack in the 12 months before the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology.
- Ransomware was present in 48% of breaches in the 2026 report, up from 44% the year before, according to Verizon.
- Business email compromise cost about $123,000 per complaint in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
- CISA added 264 vulnerabilities to its KEV catalogue in 2026 to 16 October, already 7.8% more than all of 2025, calculated by StatisticsGlobal from CISA data.
Cybercrime losses by year (FBI IC3)
The FBI Internet Crime Complaint Center (IC3) publishes the longest public series on reported cybercrime. It counts complaints from victims and the losses they report. In 2025 it passed one million complaints for the first time.
Reported losses have risen every year since 2020. They reached $20.877 billion in 2025, almost five times the 2020 figure. The average loss was $20,699 per complaint. Most of the money is lost to fraud rather than to hacking. Cyber-enabled fraud made up 45% of complaints but 85% of losses.
Two groups stand out. Complaints that involved cryptocurrency reported $11.37 billion in losses, or 54.4% of the total. Cryptocurrency is a descriptor that overlaps other crime types, so this share includes much of the investment fraud below. People aged 60 and over reported $7.7 billion, about 36.9% of all losses, more than any other age group.
IC3 figures are a floor, not a total. They only count crimes that victims chose to report to IC3. Some victims report directly to FBI field offices or not at all, and the losses exclude lost business and recovery costs.
Source: FBI Internet Crime Complaint Center, 2025 IC3 Internet Crime Report.
-
Complainants reported $20.877 billion in losses to the FBI Internet Crime Complaint Center in 2025, according to the FBI Internet Crime Complaint Center.
-
The FBI Internet Crime Complaint Center received 1,008,597 complaints in 2025, according to the FBI Internet Crime Complaint Center.
-
Losses reported to IC3 rose 26% in 2025, from $16.6 billion in 2024 to $20.877 billion, according to the FBI Internet Crime Complaint Center.
-
Losses reported to IC3 in 2025 were almost five times the $4.2 billion reported in 2020, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
How we calculated it: $20.877 billion (2025) / $4.2 billion (2020) = 4.97 times. Yearly losses from the IC3 2025 report chart "Losses by Year": 2021 $6.9 billion, 2022 $10.3 billion, 2023 $12.5 billion, 2024 $16.6 billion.
-
The average loss per complaint reported to IC3 was $20,699 in 2025, according to the FBI Internet Crime Complaint Center.
-
Cyber-enabled fraud accounted for 85% of losses reported to IC3 in 2025, or $17.70 billion, according to the FBI Internet Crime Complaint Center.
-
Complaints involving cryptocurrency reported $11.37 billion in losses in 2025, according to the FBI Internet Crime Complaint Center.
-
People aged 60 and over filed 201,266 complaints reporting $7.7 billion in losses in 2025, according to the FBI Internet Crime Complaint Center.
| Year | Reported losses | Change on previous year |
|---|---|---|
| 2020 | $4.2 billion | - |
| 2021 | $6.9 billion | +64.3% |
| 2022 | $10.3 billion | +49.3% |
| 2023 | $12.5 billion | +21.4% |
| 2024 | $16.6 billion | +32.8% |
| 2025 | $20.877 billion | +25.8% |
Most common types of cyber attack
The most common attack is not the most costly one. Phishing tops the IC3 complaint count. Investment fraud and business email compromise cause most of the losses.
Phishing and spoofing produced 191,561 complaints in 2025, 19.0% of the total. But each complaint reported only about $1,127 in losses. Business email compromise cost about $123,000 per complaint and investment fraud about $118,500.
Phishing complaints are falling. They dropped 35.9% between 2023 and 2025. Investment fraud moved the other way, with losses up 31.6% in 2025. Government impersonation complaints rose 86.7%. IC3 also logged 22,364 AI-related complaints, with $893 million in losses.
For breaches of organisations, the entry point is shifting. Verizon found vulnerability exploitation was the top initial access vector in its 2026 report, at 31% of breaches. Credential abuse fell to 13% and phishing stayed at 16%. A human element was still present in 62% of breaches.
Source: FBI Internet Crime Complaint Center, 2025 IC3 Internet Crime Report. Rounded by StatisticsGlobal.
-
Phishing and spoofing was the most reported crime type in 2025, with 191,561 complaints, according to the FBI Internet Crime Complaint Center.
-
Phishing and spoofing complaints reported about $1,127 in losses each in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
How we calculated it: $215,843,126 phishing/spoofing losses / 191,561 complaints = $1,127 per complaint (IC3 2025 report).
-
Phishing and spoofing complaints to IC3 fell 35.9% between 2023 and 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
How we calculated it: 191,561 complaints in 2025 / 298,878 in 2023 - 1 = -35.9% (IC3 2025 report, three-year complaint count comparison). 2024: 193,407.
-
Investment fraud caused the largest losses reported to IC3 in 2025, at $8.65 billion from 72,984 complaints, according to the FBI Internet Crime Complaint Center.
-
Investment fraud cost about $118,500 per complaint in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
How we calculated it: $8,648,617,756 investment fraud losses / 72,984 complaints = $118,500 per complaint (IC3 2025 report).
-
Reported investment fraud losses rose 31.6% in 2025, to $8.65 billion from $6.57 billion in 2024, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
How we calculated it: $8,648,617,756 (2025) / $6,570,639,864 (2024) - 1 = 31.6% (IC3 2025 report, three-year loss comparison).
-
Business email compromise caused $3.05 billion in reported losses in 2025 from 24,768 complaints, according to the FBI Internet Crime Complaint Center.
-
Business email compromise cost about $123,000 per complaint in 2025, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
How we calculated it: $3,046,598,558 BEC losses / 24,768 BEC complaints = $123,005 per complaint (IC3 2025 report, crime types by count and loss).
-
Government impersonation complaints rose 86.7% in 2025, from 17,367 to 32,424, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
How we calculated it: 32,424 complaints (2025) / 17,367 (2024) - 1 = 86.7%. Losses rose from $405.6 million to $797.9 million, up 96.7% (IC3 2025 report).
-
IC3 logged 22,364 AI-related complaints with $893 million in losses in 2025, according to the FBI Internet Crime Complaint Center.
-
Vulnerability exploitation was the top initial access vector at 31% of breaches in the 2026 report, ahead of credential abuse at 13%, according to Verizon.
-
A human element was present in 62% of breaches in the 2026 report, up from 60%, according to Verizon.
| Crime type | Complaints | Reported losses | Loss per complaint |
|---|---|---|---|
| Investment fraud | 72,984 | $8.65 billion | $118,500 |
| Business email compromise | 24,768 | $3.05 billion | $123,005 |
| Tech and customer support scams | 47,794 | $2.13 billion | $44,664 |
| Personal data breach | 67,456 | $1.31 billion | $19,493 |
| Confidence and romance scams | 23,159 | $929 million | $40,126 |
| Government impersonation | 32,424 | $798 million | $24,610 |
| Phishing and spoofing | 191,561 | $216 million | $1,127 |
| Extortion | 89,129 | $122 million | $1,374 |
| Ransomware | 3,611 | $32.3 million | $8,950 |
Cyber attack statistics in the US, UK and EU
Each region has a different main source. The US has victim complaints, the UK has a survey of organisations and the EU has ENISA's curated incident dataset. Phishing leads in all three.
In the UK, 43% of businesses and 28% of charities had a breach or attack in the 12 months before interview. That is about 612,000 businesses. The rate was the same as the previous survey. Larger firms report far more attacks. 69% of large businesses had one, against 42% of micro businesses, a gap of 27 points.
Phishing hit 38% of UK businesses, the most common attack by far. 19% of businesses were victims of cyber crime, about 267,000 firms. They faced about 5.19 million crimes between them, or about 19 each. Protection is patchy. 47% had some cyber insurance and 31% had a board member responsible for cyber security.
In the EU, ENISA analysed 4,875 incidents from July 2024 to June 2025. DDoS attacks made up about 76.7% of them, mostly by hacktivists, and had low impact. Among intrusion vectors, phishing accounted for about 60% and vulnerability exploitation 21.3%.
The phishing figures in the table are not comparable. One counts complaints, one counts businesses, one counts intrusion vectors and one counts breaches. They agree on the ranking, not the size.
Source: UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026.
-
43% of UK businesses, about 612,000, had a cyber breach or attack in the 12 months before the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology.
-
28% of UK charities, about 57,000, had a cyber breach or attack in the 12 months before the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology.
-
69% of large UK businesses and 65% of medium businesses had a breach or attack in the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology.
-
Large UK businesses were 27 percentage points more likely than micro businesses to report a breach or attack in the 2025/2026 survey, calculated by StatisticsGlobal from UK Department for Science, Innovation and Technology data.
How we calculated it: 69% of large businesses - 42% of micro businesses = 27 percentage points (Cyber security breaches survey 2025/2026).
-
Phishing hit 38% of UK businesses and 25% of charities in the 2025/2026 survey, the most common attack by far, according to the UK Department for Science, Innovation and Technology.
-
19% of UK businesses, about 267,000, were victims of cyber crime in the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology.
-
UK businesses experienced about 5.19 million cyber crimes in the 12 months covered by the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology.
-
UK businesses hit by cyber crime suffered about 19 crimes each on average in the 2025/2026 survey, calculated by StatisticsGlobal from UK Department for Science, Innovation and Technology data.
How we calculated it: About 5.19 million cyber crimes against businesses / about 267,000 victim businesses = 19.4 crimes per victim business. Both inputs are survey estimates.
-
47% of UK businesses and 35% of charities were insured against cyber risks in some way in the 2025/2026 survey, according to the UK Department for Science, Innovation and Technology.
-
31% of UK businesses had board members with explicit responsibility for cyber security in the 2025/2026 survey, up from 27%, according to the UK Department for Science, Innovation and Technology.
-
ENISA analysed 4,875 cyber incidents affecting the EU between July 2024 and June 2025, according to ENISA.
-
Phishing accounted for about 60% of observed intrusion vectors in the EU in the year to June 2025, according to ENISA.
-
Vulnerability exploitation accounted for 21.3% of observed intrusion vectors in the EU in the year to June 2025, according to ENISA.
-
DDoS attacks made up about 76.7% of incidents recorded in the EU in the year to June 2025, mostly by hacktivists, according to ENISA.
| Source | Scope | Phishing figure | What it measures |
|---|---|---|---|
| FBI IC3 (2025) | United States | 19.0% | Share of all complaints filed |
| UK Cyber Security Breaches Survey (2025/2026) | United Kingdom | 38% | Share of businesses hit by phishing in 12 months |
| ENISA Threat Landscape (year to June 2025) | European Union | About 60% | Share of observed intrusion vectors |
| Verizon DBIR (2026) | Worldwide | 16% | Share of breaches where phishing was the initial access vector |
Ransomware statistics
Ransomware is the most damaging threat for organisations, but it looks very different by source. It is rare in victim complaints and surveys and common in breach investigations.
Verizon found ransomware in 48% of breaches in its 2026 report, up from 44%. Yet fewer victims pay. 69% did not pay, and the median payment fell 6.8% to $139,875. Verizon says small organisations are hit disproportionately.
IC3 received 3,611 ransomware complaints in 2025, up 14.4%. Reported losses rose 159% to $32.3 million. IC3 warns this loss figure is artificially low. It leaves out downtime and recovery costs, and some victims report no loss at all.
The UK survey shows ransomware at 1% of businesses, down from 3%. The sources do agree on one name. Akira was the most reported variant to IC3 in 2025 and the most deployed in the EU, at 11.6% of ENISA's cases.
-
Ransomware was present in 48% of breaches in the 2026 report, up from 44% the year before, according to Verizon.
-
69% of ransomware victims did not pay, and the median ransom paid was $139,875, in the 2026 report, according to Verizon.
-
The median ransom paid fell 6.8% in the 2026 report, from $150,000 to $139,875, calculated by StatisticsGlobal from Verizon data.
How we calculated it: $139,875 / $150,000 - 1 = -6.75%, rounded to -6.8% (2026 DBIR Executive Summary).
-
IC3 received 3,611 ransomware complaints in 2025, with reported losses of $32.3 million, according to the FBI Internet Crime Complaint Center.
-
Ransomware complaints to IC3 rose 14.4% in 2025 while reported ransomware losses rose 159%, calculated by StatisticsGlobal from FBI Internet Crime Complaint Center data.
How we calculated it: Complaints: 3,611 (2025) / 3,156 (2024) - 1 = 14.4%. Losses: $32,320,105 / $12,473,156 - 1 = 159.1% (IC3 2025 report, three-year comparison).
-
1% of UK businesses reported ransomware in the 2025/2026 survey, down from 3% in each of the two previous surveys, according to the UK Department for Science, Innovation and Technology.
-
82 ransomware variants were deployed against EU organisations in the year to June 2025, with Akira the most frequent at 11.6%, according to ENISA.
-
20.7% of vulnerabilities in the CISA KEV catalogue were known to be used in ransomware campaigns in October 2026, calculated by StatisticsGlobal from CISA data.
How we calculated it: Entries with knownRansomwareCampaignUse "Known": 361. 361 / 1,748 = 20.7%. The rest are marked "Unknown", not "No" (catalog version 2026.10.16).
| Source | Scope and period | Ransomware figure |
|---|---|---|
| Verizon DBIR (2026) | Worldwide, October 2024 to November 2025 | In 48% of breaches (44% a year earlier). 69% of victims did not pay. Median ransom paid $139,875 |
| FBI IC3 (2025) | United States, 2025 | 3,611 complaints, $32.3 million reported losses |
| UK Cyber Security Breaches Survey (2025/2026) | United Kingdom, 12 months to late 2025 | 1% of businesses (3% in each of the two previous surveys) |
| ENISA Threat Landscape (2025) | European Union, July 2024 to June 2025 | 82 variants deployed. Akira most frequent at 11.6% |
| CISA KEV catalogue (October 2026) | Worldwide, catalogue to 16 October 2026 | 361 of 1,748 exploited vulnerabilities (20.7%) known to be used by ransomware |
Cybersecurity statistics by industry
Verizon breaks down incidents and confirmed breaches by industry. ENISA ranks EU sectors by incident share. IC3 names the critical sectors most hit by ransomware.
Industries differ in how often an incident becomes a breach. In Verizon's 2026 data, 96.4% of healthcare incidents and 96.2% of education incidents were confirmed breaches. In finance only 34.1% were, so most finance incidents did not lead to confirmed data disclosure. For hospital AI and health data trends, see our AI in healthcare statistics page.
In the EU, public administration takes 38.2% of incidents with a known sector, far ahead of transport at 7.5%. ENISA says hacktivists and state-aligned groups focus on it. In the US, IC3 says the top ransomware variants hit critical manufacturing, healthcare and government facilities most. Outside critical sectors, legal services made up 18% of ransomware complaints.
Shared suppliers spread risk across industries. Third parties were involved in 48% of breaches in Verizon's 2026 report. Verizon found only 23% of third-party organisations fully fixed missing or weak MFA on their cloud accounts. For the providers behind that cloud exposure, see our cloud market share page. Unpatched software is the other common thread. CISA listed 1,748 known exploited vulnerabilities on 16 October 2026, and 264 were added in 2026, already more than the 245 added in all of 2025. Microsoft products account for 22.3% of the catalogue. Verizon found only 26% of these vulnerabilities were fully fixed in 2025.
Source: ENISA Threat Landscape 2025, version 1.3. Excludes the 28.5% of incidents with no sector recorded.
-
Verizon analysed more than 31,000 incidents and more than 22,000 confirmed data breaches for its 2026 report, according to Verizon.
-
96.4% of healthcare incidents in the 2026 report were confirmed breaches, against 34.1% in finance, calculated by StatisticsGlobal from Verizon data.
How we calculated it: Healthcare: 1,438 confirmed breaches / 1,492 incidents = 96.4%. Financial: 1,300 / 3,809 = 34.1% (2026 DBIR Executive Summary industry tables).
-
Third parties were involved in 48% of breaches in the 2026 report, up 60% on the year before, according to Verizon.
-
Public administration was the most targeted EU sector in the year to June 2025, with 38.2% of sector-attributed incidents, according to ENISA.
-
CISA listed 1,748 known exploited vulnerabilities in its catalogue on 16 October 2026, counted by StatisticsGlobal from CISA data.
How we calculated it: Number of entries in the CISA KEV JSON feed, catalog version 2026.10.16 (the feed states count: 1748).
-
CISA added 264 vulnerabilities to its KEV catalogue in 2026 to 16 October, already 7.8% more than all of 2025, calculated by StatisticsGlobal from CISA data.
How we calculated it: Entries with dateAdded in 2026 (to 16 October): 264. Entries with dateAdded in 2025: 245. 264 / 245 - 1 = 7.8%. Earlier years: 2021 311 (catalogue launch), 2022 555, 2023 187, 2024 186.
-
Microsoft products account for 390 of 1,748 entries, or 22.3%, in the CISA KEV catalogue in 2026, calculated by StatisticsGlobal from CISA data.
How we calculated it: Entries with vendorProject "Microsoft": 390. 390 / 1,748 = 22.3%. Next: Cisco 101, Apple 95, Adobe 82, Google 75 (catalog version 2026.10.16).
-
Only 26% of CISA KEV vulnerabilities were fully remediated by organisations in 2025, down from 38%, according to Verizon.
| Industry | Incidents | Confirmed breaches | Share confirmed as breaches |
|---|---|---|---|
| Financial and insurance | 3,809 | 1,300 | 34.1% |
| Public administration | 3,634 | 2,410 | 66.3% |
| Manufacturing | 3,627 | 2,713 | 74.8% |
| Healthcare | 1,492 | 1,438 | 96.4% |
| Educational services | 1,302 | 1,252 | 96.2% |
| Retail | 997 | 806 | 80.8% |
How the sources measure cybersecurity
FBI IC3 counts complaints filed by victims, mostly in the US, and the losses they report. It does not count unreported crime, and losses exclude lost business and recovery costs. Crime types overlap, and descriptors such as cryptocurrency and AI cut across them. The yearly loss series comes from a chart in the 2025 report.
The UK Cyber Security Breaches Survey is an Ipsos survey of 2,112 businesses and 1,085 charities, with fieldwork from August to December 2025. It asks about the 12 months before interview. Costs are the cost as perceived by respondents.
ENISA analyses 4,875 incidents it selected and curated from open sources, from July 2024 to June 2025. ENISA notes that hacktivist DDoS dominates the count but has very low impact. ENISA revised the report to version 1.3 in September 2026 to correct figures. We use version 1.3.
Verizon's DBIR uses incidents shared by Verizon and partner organisations, worldwide, from October 2024 to November 2025. It is large but not a random sample. Industry counts reflect who contributes data. We use the free executive summary.
The CISA Known Exploited Vulnerabilities catalogue lists flaws with evidence of active exploitation. Its first entries are dated 3 November 2021, so the 2021 count includes older flaws added at launch. We counted entries from catalog version 2026.10.16 and keep a snapshot of the data.
Frequently asked questions
How much did cybercrime cost in 2025?
Victims reported $20.877 billion in losses to the FBI Internet Crime Complaint Center in 2025, up 26% from $16.6 billion in 2024. This counts only reported crime, so the true cost is higher.
What is the most common type of cyber attack?
Phishing. It was the most reported crime type to the FBI in 2025, with 191,561 complaints. It hit 38% of UK businesses in the 2025/2026 survey and accounted for about 60% of intrusion vectors in ENISA's EU data.
How many UK businesses had a cyber attack?
43% of UK businesses, about 612,000, had a breach or attack in the 12 months before the 2025/2026 Cyber Security Breaches Survey. The figure was 69% for large businesses and 28% for charities.
Is ransomware increasing?
In breach data, yes. Verizon found ransomware in 48% of breaches in its 2026 report, up from 44%. IC3 ransomware complaints rose 14.4% in 2025. But fewer victims pay, 69% in Verizon's data, and the median ransom fell to $139,875.
How has cybercrime changed compared with last year?
Reported losses to IC3 rose 26% in 2025. Investment fraud losses rose 31.6% and government impersonation complaints 86.7%. Phishing complaints fell slightly. CISA has already added more exploited vulnerabilities in 2026 than in all of 2025.
Is there a forecast for cybercrime in 2026?
None of these primary sources publishes a forecast. IC3 losses have risen every year since 2020, and CISA's 2026 additions already exceed 2025. We will update this page when IC3 publishes its 2026 report.
Sources
- FBI Internet Crime Complaint Center (IC3), 2025 IC3 Internet Crime Report, 2026, accessed 19 October 2026. Link · Saved data copy
- UK Department for Science, Innovation and Technology, Cyber security breaches survey 2025/2026, 30 April 2026, accessed 19 October 2026. Link · Saved data copy · Licence: Open Government Licence v3.0
- Verizon, 2026 Data Breach Investigations Report, Executive Summary, 2026, accessed 19 October 2026. Link · Saved data copy
- CISA, Known Exploited Vulnerabilities Catalog (catalog version 2026.10.16), 16 October 2026, accessed 19 October 2026. Link · Saved data copy · Licence: US government work, public domain
- ENISA, ENISA Threat Landscape 2025 (version 1.3), 1 October 2025, revised 22 September 2026, accessed 19 October 2026. Link · Saved data copy
Changes to this page
- : Page published with FBI IC3 2025 data, the UK Cyber Security Breaches Survey 2025/2026, ENISA Threat Landscape 2025 v1.3, the Verizon 2026 DBIR and CISA KEV counts to 16 October 2026.