158 Cybercrime Statistics for 2026

How much cybercrime is reported in the US?

More than a million complaints a year now reach the FBI, and the losses stated in them have grown in every annual report since 2019. These are complaints people chose to file with one agency, so they show reported harm and not all cybercrime.

View data table

Losses stated in complaints to the FBI's IC3 by year, in billions of dollars (US). Each year comes from the release for that year; the link is to the latest one. The 2019 to 2022 values are as printed in the 2023 report.

Period	Value
2019	$3.5bn
2020	$4.2bn
2021	$6.9bn
2022	$10.3bn
2023	$12.5bn
2024	$16.6bn
2025	$20.877bn

• Losses reported to the FBI's IC3 in 2025 were a 26% increase on 2024, and the average loss per complaint was $20,699 (US, complaints filed with IC3). (FBI IC3 (2025 annual report), Apr 2026)
• Cyber-enabled fraud accounted for 452,868 complaints and $17,697,074,980 in losses reported to IC3 in 2025: 45% of complaints and 85% of losses (US, complaints filed with IC3). (FBI IC3 (2025 annual report), Apr 2026)
• In 2024 IC3 received 859,532 complaints with reported losses of $16.6 billion (US, complaints filed with IC3). (FBI IC3 (2024 annual report), Apr 2025)
• In 2023 IC3 received 880,418 complaints with reported losses of $12.5 billion, against 467,361 complaints and $3.5 billion in 2019 (US, complaints filed with IC3). (FBI IC3 (2023 Internet Crime Report), Mar 2024)
• IC3 received complaints from more than 200 countries in 2025, accounting for almost $1.6 billion of losses; the foreign countries with the most complainants were Canada 7,479, India 5,879, Japan 5,764 and the United Kingdom 4,106. (FBI IC3 (2025 annual report), Apr 2026)

IC3 counts complaints filed with the FBI and the losses complainants stated in them. It is not a survey and not a total for all cybercrime, and some complaints come from people outside the US.

How much do Americans lose to fraud and scams on other measures?

It depends on who is counting. The FTC counts fraud of every kind that consumers report to its Consumer Sentinel network, and Gallup estimates losses from a survey of adults. Neither is the FBI's complaint count, and none of the three can be added to another.

View data table

Losses US consumers reported to the FTC on scams that started on social media, by year. Only reports that named social media as the contact method are counted.

Period	Value
2020	$261m
2021	$789m
2022	$1.2bn
2023	$1.5bn
2024	$1.9bn
2025	$2.1bn

• The FTC's 2025 totals compare with 2.6 million fraud reports and over $12 billion in reported losses in 2024 (US, reports to the Consumer Sentinel network). (FTC (Joint Economic Committee testimony release), Mar 2026)
• US consumers reported losing $7.9 billion to investment scams in 2025, more than to any other fraud category in FTC reports; imposter scams were the most-reported fraud, with more than 1 million reports and over $3.5 billion in reported losses. (FTC (Joint Economic Committee testimony release), Mar 2026)
• People in the US reported losing nearly $1 billion to business impersonators and about $920 million to government impersonators in 2025, up from $866 million and $789 million in 2024; nearly one in three fraud reports to the FTC were about imposter scams. (FTC (imposter scams release), Jun 2026)
• Losses US consumers reported to the FTC on scams that started on social media were $2.1 billion in 2025, against $261 million in 2020. (FTC (Data Spotlight, social media scams), Apr 2026)
• Among US fraud reports to the FTC that indicated a loss in 2025, the contact method was a website or app in 31%, social media in 28%, a phone call in 11%, email in 10% and text in 7%. (FTC (Data Spotlight, social media scams), Apr 2026)

The FBI's IC3 total, the FTC's Consumer Sentinel total and Gallup's estimate are not the same measure. IC3 counts losses in complaints filed with the FBI, the FTC counts fraud losses of all kinds reported to its network, and Gallup estimates losses from what survey respondents said. They are not added, averaged or ranked here.

Which types of cybercrime cost the most?

Investment fraud, by a wide margin, on the FBI's complaint data. The type people report most often, phishing and spoofing, is not among the largest loss categories, and cryptocurrency runs through much of the money lost.

1. 1 Phishing/Spoofing 191,561
2. 2 Extortion 89,129
3. 3 Investment 72,984
4. 4 Personal Data Breach 67,456
5. 5 Non-Payment/Non-Delivery 56,478
6. 6 Tech/Customer Support 47,794
7. 7 Government Impersonation 32,424
8. 8 Identity Theft 31,675
9. 9 Business Email Compromise 24,768
10. 10 Employment 24,688

• The crime types most often reported to IC3 in 2025 were phishing and spoofing with 191,561 complaints, extortion with 89,129, personal data breach with 67,456 and non-payment or non-delivery with 56,478; identity theft drew 31,675 and employment fraud 24,688 (US, complaints to IC3). (FBI IC3 (2025 report, crime type tables), Apr 2026)
• Investment fraud drew 72,984 complaints and $8,648,617,756 in reported losses in 2025, against 47,919 and $6,570,639,864 in 2024 and 39,570 and $4,570,275,683 in 2023 (US, complaints to IC3). (FBI IC3 (2025 report, crime type tables), Apr 2026)
• Business email compromise drew 24,768 complaints and $3,046,598,558 in reported losses in 2025, against 21,442 and $2,770,151,146 in 2024 and 21,489 and $2,946,830,270 in 2023 (US, complaints to IC3). (FBI IC3 (2025 report, crime type tables), Apr 2026)
• Tech and customer support fraud drew 47,794 complaints and $2,134,675,818 in reported losses in 2025, against 36,002 and $1,464,755,976 in 2024 and 37,560 and $924,512,658 in 2023 (US, complaints to IC3). (FBI IC3 (2025 report, crime type tables), Apr 2026)
• Government impersonation drew 32,424 complaints and $797,943,193 in reported losses in 2025, against 17,367 and $405,624,084 in 2024; confidence and romance fraud drew 23,159 complaints and $929,287,469 in 2025 (US, complaints to IC3). (FBI IC3 (2025 report, crime type tables), Apr 2026)
• Complaints of personal data breach carried $1,314,923,988 in reported losses in 2025, non-payment or non-delivery $503,373,587 and data breach $435,240,992 (US, complaints to IC3). (FBI IC3 (2025 report, crime type tables), Apr 2026)
• IC3 logged 22,364 complaints with an AI-related descriptor in 2025, with reported losses of $893,346,472; investment complaints with a reported AI link accounted for $632,041,188 of that (US, complaints to IC3). (FBI IC3 (2025 report, crime type tables), Apr 2026)
• IC3 received more than 75,000 submissions about sextortion in 2025 and referred more than 5,700 submissions involving minors to NCMEC; complainants aged 17 or younger filed 13,168 complaints with $12,988,892 in losses (US). (FBI IC3 (2025 report, crime type tables), Apr 2026)

All figures in the main list are complaints to IC3 and the losses complainants stated. IC3's cryptocurrency figures cut across crime types, so they overlap with investment, tech support and other categories and are not added to them.

Which age groups lose the most money to cybercrime?

People aged 60 and over, on the FBI's complaint data: they file the most complaints and state the largest losses. Surveys point the other way on how often it happens, with younger adults more likely to say they have lost money to an online scam.

View data table

Losses stated in complaints to the FBI's IC3 in 2025 by age group of the complainant (US). Only complaints that gave an age are included.

Period	Value
Under 20	$67.1m
20-29	$563.1m
30-39	$1.7bn
40-49	$2.957bn
50-59	$3.7bn
60+	$7.7bn

• Complaints to IC3 from people aged 60 and over were a 37% increase on 2024 and their reported losses a 59% increase; the average loss was $38,500 and 12,444 complainants lost more than $100,000 (US, 2025). (FBI IC3 (2025 report, elder fraud), Apr 2026)
• Among US complainants aged 60 and over in 2025, reported losses were $3,519,296,354 to investment fraud, $1,040,730,043 to tech and customer support fraud, $584,032,745 to confidence and romance fraud, $568,048,472 to business email compromise and $413,206,251 to government impersonation (complaints to IC3). (FBI IC3 (2025 report, elder fraud), Apr 2026)
• Complainants aged 50-59 reported $3.7 billion in losses to IC3 in 2025 in 124,820 complaints, those aged 40-49 $2.957 billion in 167,066 and those aged 30-39 $1.7 billion in 153,293; people under 20 filed 31,254 complaints with $67.1 million (US, complainants who gave an age). (FBI IC3 (2025 report, age tables), Apr 2026)
• Fraud losses reported to the FTC by US adults aged 60 and over rose from about $600 million in 2020 to approximately $3 billion in 2025 (reports to the FTC, fraud of all kinds). (FTC (older adults report release), Oct 2026)
• The FTC's own estimate is that the overall cost of fraud to older adults in the US in 2025 "could be as high as $119.5 billion"; this is an estimate by the agency, not a count of reports. (FTC (older adults report release), Oct 2026)
• About a quarter of US adults aged 18 to 29 say they have lost money because of an online scam or attack, compared with 15% of those 65 and older (Pew survey of US adults, April 2025). (Pew Research Center (Online Scams and Attacks in America Today), Jul 2025)
• 84% of US adults say adults 65 and older are extremely or very likely to fall victim to online scams and attacks, against 22% who say this of adults 30 and under (Pew survey, April 2025). (Pew Research Center (Online Scams and Attacks in America Today), Jul 2025)

IC3 and FTC figures are reports to two different agencies and are not added together. The Pew figure is the share of adults who say they have ever lost money, which says nothing about the amounts lost.

Which US states report the most cybercrime?

The largest states file the most complaints and state the largest losses. Per resident the order changes: the District of Columbia, Alaska and Nevada lead the FBI's per-capita table.

1. 1 California 116,414
2. 2 Texas 97,912
3. 3 Florida 71,843
4. 4 New York 45,255
5. 5 Illinois 32,977
6. 6 Pennsylvania 31,154
7. 7 Arizona 28,868
8. 8 Ohio 27,626
9. 9 North Carolina 25,940
10. 10 Georgia 25,936

• California residents filed 116,414 complaints with IC3 in 2025, Texas 97,912, Florida 71,843, New York 45,255 and Illinois 32,977 (US, complaints by state of the complainant). (FBI IC3 (2025 report, state tables), Apr 2026)
• Next by complaints to IC3 in 2025 were Pennsylvania 31,154, Arizona 28,868, Ohio 27,626, North Carolina 25,940 and Georgia 25,936 (US). (FBI IC3 (2025 report, state tables), Apr 2026)
• By losses reported to IC3 in 2025, California stood at $3,674,716,305, Texas at $1,825,636,181, Florida at $1,596,138,595 and New York at $1,226,307,877 (US). (FBI IC3 (2025 report, state tables), Apr 2026)
• The next states by losses reported to IC3 in 2025 were New Jersey $660,411,901, Arizona $630,700,609, Pennsylvania $537,787,231, Illinois $535,255,201, Georgia $534,581,965 and Virginia $476,120,025 (US). (FBI IC3 (2025 report, state tables), Apr 2026)
• IC3 complaints per 100,000 residents in 2025 were 448.8 in the District of Columbia, 434.3 in Alaska, 407.2 in Nevada, 378.7 in Arizona and 320.6 in Massachusetts, the first five places in the FBI's own ranking (US). (FBI IC3 (2025 report, state tables), Apr 2026)
• At the other end of the FBI's per-capita table for 2025 were Puerto Rico with 129.0 complaints per 100,000 residents, Iowa 167.9, Mississippi 172.1, North Dakota 177.4 and Nebraska 184.5 (US). (FBI IC3 (2025 report, state tables), Apr 2026)

State figures are complaints filed with IC3 and the losses stated in them, by the state of the complainant. A complaint rate measures how many people filed, which is not the same as how many were victims.

How common is ransomware and what do victims pay?

No two producers measure ransomware the same way, so there is no single payment figure. Complaints to the FBI, blockchain tracing, incident responders' cases and surveys each describe a different group of victims, and each is given on its own below.

View data table

Ransomware complaints filed with the FBI's IC3 by year (US). These are complaints to one agency and say nothing about ransom payments measured by other producers.

Period	Value
2023	2,825
2024	3,156
2025	3,611

• The FBI's IC3 received 3,611 ransomware complaints in 2025 with $32,320,105 in reported losses; complaints were 3,156 in 2024 and 2,825 in 2023, and reported losses $12,473,156 in 2024 and $59,641,384 in 2023 (US, complaints to IC3). (FBI IC3 (2025 report, ransomware), Apr 2026)
• 63 new ransomware variants were identified through IC3 in 2025, an average of 5.25 per month; the most frequently reported variants accounted for 56.8% of ransomware incidents reported and 49.8% of reported ransomware losses (US, complaints to IC3). (FBI IC3 (2025 report, ransomware), Apr 2026)
• IC3 received more than 1,400 ransomware complaints in 2025 from US businesses and organisations outside the critical infrastructure sectors: 18% from legal services, 17% contracting services, 10% engineering and architectural services and 7% consulting services. (FBI IC3 (2025 report, ransomware), Apr 2026)
• Europol observed more than 120 active ransomware brands in 2025 (EU law enforcement assessment). (Europol (IOCTA 2026), 2026)
• Microsoft Defender observed a 15.8% year-on-year increase in ransomware detonations against enterprises in the firm's 2026 reporting period, July 2025 to June 2026; Microsoft says the United States remained the country most impacted by ransomware (Microsoft's own telemetry). (Microsoft (Digital Defense Report 2026), Sep 2026)

Ransom payment medians and averages differ by producer because the samples differ: Chainalysis traces payments on the blockchain worldwide, Coveware reports the cases it handled, Verizon reports its own breach dataset and Sophos surveys organisations of 100 to 5,000 employees. The figures are not combined into a range and not compared as equals.

How common are fraud and computer misuse in England and Wales?

Very common on the survey measure, and far less visible in recorded reports. The Crime Survey estimates millions of fraud incidents a year against adults, while Report Fraud records a few hundred thousand reports made directly to it.

View data table

Estimated computer misuse incidents against adults in England and Wales, in thousands, from the Crime Survey. The table has no estimates for the years ending March 2021 and March 2022, and the last two periods overlap.

Period	Value
YE Mar 2017	1,764
YE Mar 2018	1,227
YE Mar 2019	966
YE Mar 2020	876
YE Mar 2023	745
YE Mar 2024	1,022
YE Mar 2025	692
YE Mar 2026	798
YE Jun 2026	817

• Fraud incidents in the Crime Survey for England and Wales for the year ending June 2026 were an 11% increase on the previous year's survey (4.1 million); bank and credit account fraud rose 13% to 2.8 million incidents (adults 16 and over, survey estimate). (ONS (Crime in England and Wales, year ending June 2026), Oct 2026)
• Computer misuse incidents in the Crime Survey for the year ending June 2026 were a 23% increase on the previous year's survey (663,000), driven by a 29% rise in unauthorised access to personal information, to 689,000; the total was still around 54% lower than in the year ending March 2017 (around 1.8 million) (England and Wales, adults 16 and over). (ONS (Crime in England and Wales, year ending June 2026), Oct 2026)
• Report Fraud recorded 348,944 fraud offences reported to it directly in the year ending June 2026, up 15%, and 62,241 computer misuse offences, up 9% from 57,245 (England and Wales, recorded reports). (ONS (Crime in England and Wales, year ending June 2026), Oct 2026)
• In the year ending June 2026 Cifas referred 405,990 fraud offences to Report Fraud and UK Finance referred around 1 million fraud information reports (recorded reports from industry bodies with UK-wide members). (ONS (Crime in England and Wales, year ending June 2026), Oct 2026)
• 7.8% of adults in England and Wales (3.8 million people) were victims of fraud once or more in the year ending June 2026, and 1.4% (707,000) were victims of computer misuse (Crime Survey, adults 16 and over). (ONS (appendix tables, year ending June 2026), Oct 2026)
• In fraud incidents where money was taken, 74% of victims in England and Wales were refunded in full, 3% partially and 18% not at all; for bank and credit account fraud 86% were refunded in full, for consumer and retail fraud 57% (Crime Survey, year ending June 2026). (ONS (appendix tables, year ending June 2026), Oct 2026)
• Police in England and Wales flagged 294,050 recorded offences as online crime in the year ending June 2026, 5.6% of offences; 65.3% of blackmail offences (23,213) and 31.5% of harassment and stalking offences (177,762) carried the online flag (police recorded crime). (ONS (appendix tables, year ending June 2026), Oct 2026)
• 55.8% of fraud incidents against adults in England and Wales were flagged as cyber-related in the year ending March 2025, against 48.5% the year before; the median loss among frauds involving a financial loss was £85 (Crime Survey, adults 16 and over). (ONS (nature of crime tables, year ending March 2025), Mar 2026)

Three measures appear here. The Crime Survey for England and Wales is a household survey estimate of crimes experienced by adults aged 16 and over, reported or not. Report Fraud, Cifas and UK Finance figures are recorded reports. The online-crime flag is applied by police to the offences they record. The three are not comparable.

How many UK businesses and charities are hit by cyber crime?

About one business in five and one charity in seven in a year, on the government's survey. Nearly all of the crimes counted are phishing, and the typical cost reported for the rest is a few hundred pounds.

View data table

Share of UK businesses that were victims of at least one cyber crime in the past year, by business size (survey estimate, 2025/2026).

Period	Value
Micro	17%
Small	24%
Medium	41%
Large	48%

• The survey's estimate of organisations that identified a cyber security breach or attack in the previous 12 months equals approximately 612,000 UK businesses and 57,000 UK charities (2025/2026). (DSIT and Home Office (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• 19% of UK businesses and 14% of UK charities were victims of at least one cyber crime in the past year, approximately 267,000 businesses and 28,000 charities (UK, survey estimate, 2025/2026). (DSIT and Home Office (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• UK businesses experienced an estimated 5.19 million cyber crimes of all types in the last 12 months, including about 70,000 non-phishing cyber crimes; UK charities experienced about 525,000 (UK, extrapolated from the survey, 2025/2026). (DSIT and Home Office (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• The median perceived cost of a cyber crime other than phishing to UK businesses was £250 including zero-cost cases and £750 excluding them; the 90th percentile was £5,000 and £7,500 respectively (UK businesses that experienced non-phishing cyber crime, 2025/2026). (DSIT and Home Office (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• 1% of UK businesses identified a ransomware attack in the last 12 months, down from 3% in both 2024/2025 and 2023/2024; 49% of businesses and 34% of charities had a rule or policy not to pay ransomware demands (UK, survey, 2025/2026). (DSIT and Home Office (Cyber Security Breaches Survey 2025/2026), Apr 2026)
• The UK National Cyber Security Centre's incident management team received 1,831 reports of cyber attacks in the year to 31 August 2026; 337 incidents required its support, of which 80 were classed as nationally significant, and its Early Warning service notified 8,500 organisations of a suspected compromise. (NCSC (Annual Review 2026), Nov 2026)

The Cyber Security Breaches Survey is a survey of UK organisations, so its figures are estimates and count cyber crime separately from breaches or attacks of any kind. The NCSC figures are one agency's caseload, not a count of all UK incidents.

How much cybercrime is recorded in the EU?

The EU's cybersecurity agency logs thousands of incidents a year, and most are denial-of-service attacks driven by ideology, not money. Its dataset is drawn mainly from open sources, so it shows what became publicly known and is not a crime count.

1. 1 Public administration 31.8%
2. 2 Business services 8.5%
3. 3 Transport 8%
4. 4 Manufacturing 6.9%
5. 5 Finance/banking 5.6%

• DDoS attacks were 51.3% of the incidents ENISA recorded in the EU in 2025 and unauthorised access 39.5% (EU, ENISA's own incident dataset). (ENISA (2026 threat report), Sep 2026)
• By assessed objective, 57.3% of incidents recorded by ENISA in the EU in 2025 were ideology-driven, 29.2% financially motivated and 6.3% cyberespionage; ransomware made up 47.3% of financially motivated activity. (ENISA (2026 threat report), Sep 2026)
• Public administration accounted for 31.8% of incidents in ENISA's 2025 EU dataset, business services 8.5%, transport 8%, manufacturing 6.9% and finance and banking 5.6%; essential entities were 72.9% of recorded incidents. (ENISA (2026 threat report), Sep 2026)
• Within EU public administration, which ENISA calls "the most targeted sector", central entities accounted for 35.1% of events, local entities 33.8% and regional entities 10.1%; ideology-driven DDoS attacks made up 81.8% of the recorded incidents against the sector. (ENISA (2026 threat report), Sep 2026)
• Of identified ransomware claims against EU organisations in 2025, 26.5% named organisations in Germany, 14.7% France, 13.6% Italy, 12.2% Spain and 4.7% the Netherlands; by sector, manufacturing drew 25.2% and business services 18.7% of claimed ransomware deployments (ENISA's dataset of claims). (ENISA (2026 threat report), Sep 2026)
• 21.54% of EU enterprises with 10 or more employees experienced ICT security incidents with consequences in 2023; 3.43% had ICT services made unavailable by an attack from outside, against 17.97% by hardware or software failure, and 1.89% had data destroyed or corrupted by malicious software or intrusion (EU enterprise survey). (Eurostat (ICT security in enterprises), Dec 2024)
• In 2024, 92.76% of EU enterprises with 10 or more employees used at least one ICT security measure: 83.69% strong password authentication, 79.23% data backup to a separate location or cloud, and 49.64% a VPN; 59.97% made staff aware of their ICT security obligations. (Eurostat (ICT security in enterprises), Dec 2024)

ENISA counts incidents affecting the EU that it collected mainly from open sources and from Member States; ransomware shares are based on claims. Eurostat's figures come from its survey of enterprises, and its incident figure includes failures as well as attacks. The two are different measures.

How much cybercrime do German police record?

Most cases German police record now involve an offender abroad or at an unknown location, and very few of those are cleared. These are police-recorded cases, so they are not comparable with the victim surveys elsewhere on this page.

• Foreign-origin cases 207,888
• Domestic cases 126,034

• Of the cybercrime cases German police recorded in 2025, 126,034 involved offenders acting inside Germany, down 4.1%, and 207,888 were cases where the offender was abroad or at an unknown location, about +3%; cybercrime was 2.3% of all recorded offences. (BKA (Bundeslagebild Cybercrime 2025), May 2026)
• The clearance rate for cybercrime recorded by German police in 2025 was 31.4% for domestic cases and 2.0% for foreign-origin cases. (BKA (Bundeslagebild Cybercrime 2025), May 2026)
• 1,041 ransomware attacks were reported to German police in 2025, 10% more than in 2024 (950); 7% of victims in the national case survey said they paid a ransom, against 9% in 2024, and ransomware payments in Germany were equivalent to USD 15,515,377. (BKA (Bundeslagebild Cybercrime 2025), May 2026)
• Deutsche Telekom recorded more than 36,000 DDoS attacks on targets in its network in 2025 (36,706 in the report's figure), up 25% from 29,399 in 2024 and an average of over 3,000 a month (Germany, one network operator's count as published by the BKA). (BKA (Bundeslagebild Cybercrime 2025), May 2026)

These are police-recorded cases from the German police crime statistics. The BKA reports domestic and foreign-origin cases separately, and the clearance rates above follow that split. The Deutsche Telekom figure is a company's count of attacks on its own network, not a police figure.

How much cybercrime is reported in Canada?

Three official sources give three different pictures: reports to the anti-fraud centre, a survey of businesses and crimes recorded by police. None of them is a national total, and investment fraud accounts for about half the losses reported to the centre.

1. 1 Investments $351m
2. 2 Spear phishing $67.9m
3. 3 Relationship $63.3m
4. 4 Job $50.6m
5. 5 Fraud investigator $28.3m
6. 6 Recovery pitch $25.9m
7. 7 Extortion $23m
8. 8 Service $19.5m
9. 9 Merchandise $11.7m
10. 10 Prize $5.7m

• Canada's top frauds by reported dollar loss in 2025 were investments at $351 million (4,409 reports, 3,867 victims), spear phishing at $67.9 million (813 reports), relationship fraud at $63.3 million (1,093 reports) and job fraud at $50.6 million (2,148 reports) (CAD, reports to the Canadian Anti-Fraud Centre). (Canadian Anti-Fraud Centre (Top 10 frauds in 2025), Feb 2026)

The Canadian Anti-Fraud Centre counts fraud reports made to it, Statistics Canada's business figures come from a survey of businesses with 10 or more employees, and its police-reported figures count incidents recorded by police. The police-reported figures are given for their reference year, 2024, as published in November 2025.

How much cybercrime is reported in Australia?

Australia shows the gap between surveys and reports plainly. Nearly half of the adults in the national cybercrime survey say they were a victim within a year, while the national reporting service receives tens of thousands of reports.

View data table

Average self-reported cost of cybercrime per report by Australian businesses in 2025-26, by business size, in Australian dollars.

Period	Value
Small business	$55,400
Medium business	$141,300
Large business	$148,100

• The average self-reported cost of cybercrime per report to Australia's ReportCyber in 2025-26 was $33,000 for individuals and $93,500 for businesses, up 16% for businesses (AUD, reports to the Australian Signals Directorate). (ASD (Annual Cyber Threat Report 2025-26), Oct 2026)
• By business size, the average self-reported cost per cybercrime report in Australia in 2025-26 was $55,400 for small business, $141,300 for medium business, up 45%, and $148,100 for large business, down 27% (AUD). (ASD (Annual Cyber Threat Report 2025-26), Oct 2026)
• ASD's Australian Cyber Security Centre responded to over 1,500 cyber security incidents in 2025-26, up 20% from the previous year, including 139 ransomware incidents; it answered over 37,500 calls to the Australian Cyber Security Hotline, down 12%. (ASD (Annual Cyber Threat Report 2025-26), Oct 2026)

ASD figures are reports to ReportCyber and the agency's own caseload. The Australian Institute of Criminology figures are estimates from a survey of online Australians. The National Anti-Scam Centre combines scam reports from five organisations and covers scams by any channel. All dollar amounts are Australian dollars and the three sources are not comparable.

How much cybercrime goes unreported?

Most of it, wherever it has been measured. The size of the gap depends on who was asked and on what counts as reporting, so each figure below names the survey, the country and who the report was made to.

1. 1 Fraud and scams 13.7%
2. 2 Identity crime and misuse 13.0%
3. 3 Online abuse and harassment 11.7%
4. 4 Malware 7.0%

• 21% of US adults say they have ever lost money to an online scam or attack; of those, 26% reported it to law enforcement, rising to 42% among those whose finances were hurt a great deal or a fair amount (Pew survey of US adults, April 2025). (Pew Research Center (Online Scams and Attacks in America Today), Jul 2025)
• In 2021 about 23.9 million people, 9% of US residents age 16 or older, had been victims of identity theft in the prior 12 months; about 7% of victims reported the incident to police and 67% contacted a credit card company or bank (US household survey). (Bureau of Justice Statistics (Victims of Identity Theft, 2021), Oct 2023)
• About 59% of US identity theft victims in 2021 had financial losses of $1 or more, totalling $16.4 billion (US household survey, identity theft by any channel). (Bureau of Justice Statistics (Victims of Identity Theft, 2021), Oct 2023)
• 11% of Canadian businesses impacted by cyber security incidents reported them to police in 2025, against 13% in 2023 (survey of businesses with 10 or more employees). (Statistics Canada (business cyber security survey, 2025), Oct 2026)
• Among impacted Canadian businesses that did not report an incident to police in 2025, 45% said incidents were resolved internally, 33% that they were too minor and 27% that there was no requirement to report. (Statistics Canada (business cyber security survey, 2025), Oct 2026)
• In Australia, 13.7% of fraud and scam victims made an official report to police or ReportCyber, as did 13.0% of identity crime and misuse victims, 11.7% of online abuse and harassment victims and 7.0% of malware victims (2025 survey of online Australians). (Australian Institute of Criminology (Cybercrime in Australia 2025), Jun 2026)

"Reported" means something different in each source: to law enforcement in the Pew survey, to police in the US identity theft survey and the Canadian business survey, and to police or the ReportCyber service in the Australian survey. The populations differ too, so the rates are not compared with one another.

What does a breach cost, and what do security firms see?

The figures here come from firms' own studies, cases and customers. Each one describes that firm's sample and not all incidents, so they are read one at a time and not set against the reported losses above.

1. 1 Manufacturing 2,713
2. 2 Public 2,410
3. 3 Healthcare 1,438
4. 4 Financial 1,300
5. 5 Educational Services 1,252
6. 6 Retail 806

• IBM describes the global average breach cost in its 2026 report as a record; the study covered 602 organisations that experienced a data breach. (IBM (Cost of a Data Breach Report 2026), Jul 2026)
• The 2026 Verizon DBIR analysed more than 31,000 security incidents, of which more than 22,000 were confirmed data breaches, at organisations in 145 countries (incidents between 1 November 2024 and 31 October 2025). (Verizon (2026 DBIR executive summary), May 2026)
• Breaches with third-party involvement reached 48% of breaches in Verizon's 2026 dataset, and a human element was present in 62% (global, Verizon's own dataset). (Verizon (2026 DBIR executive summary), May 2026)
• In the 2026 DBIR dataset the financial sector had 3,809 incidents and 1,300 confirmed breaches, the public sector 3,634 and 2,410, manufacturing 3,627 and 2,713 and healthcare 1,492 and 1,438; small and medium businesses accounted for 7,256 incidents and 7,152 breaches (global, Verizon's own dataset). (Verizon (2026 DBIR executive summary), May 2026)
• By region, the 2026 DBIR dataset holds 12,371 incidents and 8,426 breaches in Northern America, 8,245 and 6,060 in EMEA, 5,229 and 2,855 in APAC and 813 and 718 in Latin America and the Caribbean; a financial motive was present in 76% of EMEA breaches (global, Verizon's own dataset). (Verizon (2026 DBIR executive summary), May 2026)
• Global median dwell time, the days an attacker is present before detection, rose to 14 days in 2025 from 11 days in 2024 in Mandiant's own incident investigations; the median was 122 days for cyber espionage and North Korean IT worker cases. (Mandiant (M-Trends 2026), Mar 2026)
• In Mandiant's 2025 investigations, organisations first detected malicious activity internally in 52% of cases, against 43% in 2024; the high tech sector accounted for 17% of investigations and the financial sector 14.6%, and email phishing was the initial vector in 6% of intrusions (global, the firm's own cases). (Mandiant (M-Trends 2026), Mar 2026)
• The average eCrime "breakout time" in intrusions tracked by CrowdStrike fell to 29 minutes in 2025, which the firm describes as a 65% increase in speed from 2024 (global, the firm's own data). (CrowdStrike (2026 Global Threat Report release), Feb 2026)
• CrowdStrike reports that activity by AI-enabled adversaries rose 89% year over year in 2025, that it tracks more than 280 named adversaries, and that 42% of vulnerabilities were exploited before public disclosure (global, the firm's own data). (CrowdStrike (2026 Global Threat Report release), Feb 2026)
• In Microsoft's table of countries where its customers were most frequently impacted by cyber threats from January to June 2026, the United States had 25.5% of the total, Israel 7.6%, Ukraine 4.8%, Taiwan 3.9% and the United Kingdom 3.8%; Canada had 1.8%, Germany 1.7% and Australia 1.5% (Microsoft's own customer data). (Microsoft (Digital Defense Report 2026), Sep 2026)
• By sector, government agencies and services accounted for 27% of those impacted by threat actors in Microsoft's 2026 reporting period, July 2025 to June 2026, information technology 17%, research and academia 14%, communications infrastructure 9%, and transportation and non-government organisations 8% each (global, Microsoft's own data). (Microsoft (Digital Defense Report 2026), Sep 2026)

IBM's figure is a cost per breach among the organisations it studied. Verizon, Mandiant, CrowdStrike and Microsoft publish counts and shares from their own cases, contributors and customers. None of these is a measure of all cybercrime, and none is compared with complaints, police records or victim surveys.

What is being done about cybercrime?

Agencies publish their own counts of money frozen, servers taken down and arrests made. These are operating results as the agencies state them, and money frozen is not the same as money returned to victims.

• The IC3 Recovery Asset Team's Financial Fraud Kill Chain handled 3,900 incidents in 2025 involving $1,163,919,846 in attempted theft and froze $679,013,183, a 58% success rate (US, the FBI's own figures). (FBI IC3 (2025 annual report), Apr 2026)
• The FBI's Operation Level Up, launched in January 2024, has notified more than 8,000 victims of cryptocurrency investment fraud, with $500 million in estimated savings; in 2025 it notified 3,780 victims, 78% of whom were unaware they were being scammed, with estimated savings of $225,871,319 (US). (FBI IC3 (2025 annual report), Apr 2026)
• In 2025 the FBI enabled approximately 175 arrests through 13 joint operations with India's Central Bureau of Investigation and local law enforcement against call centre fraud; since 2022 there have been more than 475 arrests across 27 joint operations (US and India). (FBI IC3 (2025 annual report), Apr 2026)
• The US Justice Department says its Scam Center Strike Force "Disruption Week" in May 2026 led to disruptions across more than 1.4 million social media and email accounts, over $3.8 million in cryptocurrency voluntarily frozen by private sector firms and seven arrests in Thailand. (US Department of Justice (Scam Center Strike Force release), Jun 2026)
• Europol reports that Operation Endgame, which it coordinated, took down around 300 servers worldwide in a May 2025 action, neutralised 650 domains and led to international arrest warrants against 20 targets; a November 2025 action took down or disrupted more than 1,000 servers worldwide. (Europol (IOCTA 2026), 2026)
• A cryptocurrency mixing service taken down in November 2025 with Europol support had mixed over €1.3 billion in Bitcoin since 2016; the operation confiscated more than €25 million in cryptocurrencies and over 12 terabytes of data (Europol's account of an operation in Switzerland and Germany). (Europol (IOCTA 2026), 2026)

Methodology and sources

Every figure on this page is taken from the producer's own report, table or release and links to it; nothing is taken from news coverage or second-hand lists. Complaints and reports to an agency (FBI IC3, FTC, Canadian Anti-Fraud Centre, ReportCyber, Report Fraud), police-recorded crime (Germany, Canada, the online flag in England and Wales), victim surveys (the Crime Survey for England and Wales, Pew, Gallup, the Bureau of Justice Statistics, the Australian Institute of Criminology, the UK and Canadian business surveys) and security firms' own cases and customer data are different measures. They are stated separately with the country, the period and what was counted, and are never added, averaged or charted together. Ransom payment figures are given per producer and sample with no combined range. Estimates and forecasts are labelled with who made them, and the Chainalysis totals are the firm's estimates at the time of publication. Where the years of a chart come from several annual reports, the caption says so. Currencies are as published: US dollars unless marked CAD, AUD, £ or €. Figures are checked against their sources and refreshed monthly.

• ASD (Annual Cyber Threat Report 2025-26) · Oct 2026
• Australian Institute of Criminology (Cybercrime in Australia 2025) · Jun 2026
• BKA (Bundeslagebild Cybercrime 2025) · May 2026
• Bureau of Justice Statistics (Victims of Identity Theft, 2021) · Oct 2023
• Canadian Anti-Fraud Centre (Top 10 frauds in 2025) · Feb 2026
• Chainalysis (2026 Crypto Crime Report, introduction) · Jan 2026
• Chainalysis (2026 Crypto Crime Report, ransomware) · Feb 2026
• Chainalysis (2026 Crypto Crime Report, scams) · Jan 2026
• Coveware (Q4 2025 report) · Feb 2026
• Coveware by Veeam (Q2 2026 report) · Jul 2026
• Coveware by Veeam (Q3 2026 report) · Oct 2026
• CrowdStrike (2026 Global Threat Report release) · Feb 2026
• DSIT and Home Office (Cyber Security Breaches Survey 2025/2026) · Apr 2026
• ENISA (2026 threat report) · Sep 2026
• Europol (IOCTA 2026) · 2026
• Eurostat (ICT security in enterprises) · Dec 2024
• FBI IC3 (2023 Internet Crime Report) · Mar 2024
• FBI IC3 (2024 annual report) · Apr 2025
• FBI IC3 (2025 annual report) · Apr 2026
• FTC (Data Spotlight, social media scams) · Apr 2026
• FTC (imposter scams release) · Jun 2026
• FTC (Joint Economic Committee testimony release) · Mar 2026
• FTC (older adults report release) · Oct 2026
• Gallup (Crime poll, October 2025) · Oct 2025
• Gallup (scam victims survey) · Jun 2026
• IBM (Cost of a Data Breach Report 2026) · Jul 2026
• ISC2 (2025 Cybersecurity Workforce Study) · Dec 2025
• Mandiant (M-Trends 2026) · Mar 2026
• Microsoft (Digital Defense Report 2026) · Sep 2026
• NAIC (cyber insurance market report release) · Oct 2026
• National Anti-Scam Centre (Targeting scams report 2025) · Mar 2026
• NCSC (Annual Review 2026) · Nov 2026
• ONS (appendix tables, year ending June 2026) · Oct 2026
• ONS (Crime in England and Wales, year ending June 2026) · Oct 2026
• ONS (nature of crime tables, year ending March 2025) · Mar 2026
• Pew Research Center (Online Scams and Attacks in America Today) · Jul 2025
• Sophos (State of Ransomware 2026) · 2026
• Statistics Canada (business cyber security survey, 2025) · Oct 2026
• Statistics Canada (StatsCAN Plus, police-reported cybercrime) · Nov 2025
• US Bureau of Labor Statistics (Occupational Outlook Handbook) · Aug 2026
• US Department of Justice (Scam Center Strike Force release) · Jun 2026
• Verizon (2026 DBIR executive summary) · May 2026