Global Cybersecurity Statistics: Cybercrime Losses, Ransomware and Breach Costs

No single dataset measures global cybercrime. This report combines three public sources: complaints and losses reported to the FBI's IC3 (mainly US victims), ENISA's analysis of publicly reported incidents in the EU, and IBM's survey-based estimate of what a data breach costs an organisation.

Each measures something different, so the figures should not be added together.

IC3 received 1,008,597 complaints in 2025 with reported losses of USD 20.877 billion, a 26% increase from 2024 [1]. The average loss per complaint was USD 20,699 [1]. Reported losses have grown every year since 2020, when they were USD 4.2 billion [1].

In 2024 IC3 received 859,532 complaints and recorded USD 16.6 billion in losses, a 33% increase from 2023 [2]. Phishing/spoofing, extortion and personal data breaches were the top three crime types by complaint count in 2024 [2].

Fraud dominates the losses. In 2025 IC3 received about 453,000 cyber-enabled fraud complaints with losses above USD 17.7 billion, and investment fraud made up nearly 49% of scam-related losses [3]. Americans over 60 reported about USD 7.7 billion in losses in 2025, up 37% from 2024 [3].

IC3 ransomware complaints rose 11.7% from 2,825 in 2023 to 3,156 in 2024, as reported by The HIPAA Journal from the IC3 report [7]. The FBI said ransomware was again the most pervasive threat to US critical infrastructure in 2024, with complaints up 9% [8].

In the EU, ENISA's 2024 Threat Landscape found ransomware hit sectors broadly, with business services in 18% of ransomware events, manufacturing in 17% and health in 8% [9]. ENISA's 2025 report found ransomware made up 81.1% of cybercrime incidents targeting EU organisations and data breaches 15.2%, according to a DIGITAL SME summary [10].

ENISA's Threat Landscape 2024, covering mid-2023 to mid-2024, observed 11,079 incidents, including 322 that targeted two or more EU Member States [9]. It identified seven prime threats, led by threats against availability, then ransomware and threats against data [6][9].

Public administration accounted for 19% of reported incidents, followed by transport (11%) and finance (9%), according to a summary of the ENISA report [11]. ENISA's own finance sector report confirms that 9% of incidents targeted finance, the third-most targeted sector [12]. Over 19,754 vulnerabilities were identified between July 2023 and June 2024, with 9.3% rated critical and 21.8% high [11].

The 2025 edition analysed 4,875 incidents from 1 July 2024 to 30 June 2025 [6]. ENISA has since published a 2026 edition covering incidents from 1 January to 31 December 2025 [13].

IBM's 2026 Cost of a Data Breach Report puts the global average cost of a breach at USD 4.99 million, a 12% increase and a record high [4]. IBM reported a 56% increase in AI-driven attacks, led by deepfake impersonation and AI-enabled malware [4].

The year before, the 2025 report found the global average had fallen 9% to USD 4.44 million from USD 4.88 million, the first decline in five years [5]. Breaches were identified and contained in a mean of 241 days, the lowest in nine years [5]. The United States average rose 9% to USD 10.22 million [14].

IBM's 2026 study covered breaches at 602 organisations between March 2025 and February 2026, and found one in four malicious breaches were AI-enabled [15].

IC3 figures are complaints and losses reported by victims, mostly in the United States; they undercount actual crime because many victims do not report [1][2]. ENISA figures are based on publicly reported incidents and voluntary information sharing, which ENISA says do not form a complete picture [6]. IBM figures come from Ponemon Institute research on breached organisations and are averages per breach, not totals [4][15].

Some ENISA sector shares are taken from secondary summaries (Industrial Cyber, Vicarius, DIGITAL SME) that report the ENISA figures; ENISA is the original publisher. IBM report years refer to publication year; each covers breaches in roughly the preceding 12 months. No freereports.online calculations are used in this report.