📊 Cybercrime Statistics 2026: 52 Verified Facts on Losses, AI Attacks, and Credential Theft
Cybercrime Statistics 2026: 52 Verified Facts on Losses, AI Attacks, and Credential Theft — key points at a glance
By Jamie Hargreaves, BestPasswordGenerator.org · 9 October 2026 · 11 min read · 52 statistics
Bottom Line Up Front: Cybercrime cost US victims a record $16.6 billion in 2024, a 33% jump year over year. Stolen passwords remained the single most common entry point, appearing in 22% of all confirmed data breaches, and Microsoft blocked more than 7,000 password attacks every second. AI is now being used by both nation-state actors and financially motivated criminals to write more convincing phishing lures, automate credential attacks, and move faster inside compromised networks. This page compiles 52 cited statistics from the FBI IC3, Verizon DBIR, Microsoft Digital Defense Report, IBM, NIST, LastPass, and Google so researchers, journalists, and security teams can verify every number at its primary source.
The raw numbers behind cybercrime change every year, but the structural story stays depressingly consistent: defenders are understaffed, attackers are well-funded, and the initial access method of choice remains a stolen or guessed password. What has shifted dramatically since 2024 is the role of artificial intelligence on both sides of the line, and the data now shows that measurable.
Each of the 52 statistics below is attributed to its original primary-source report. We have organized them across seven sections so you can jump straight to the category you need: overall scale, financial cost, attack vectors, AI threats, ransomware and BEC, or what actually works to reduce risk.
Key Statistics at a Glance
If you only retain seven numbers about cybercrime in 2026, make them these:
$16.6 billion in US cybercrime losses in 2024, up 33% from 2023 Source: FBI IC3 Internet Crime Report, 2024
859,532 cybercrime complaints filed with the FBI IC3 in 2024 Source: FBI IC3 Internet Crime Report, 2024
600 million cyberattacks per day directed at Microsoft’s customers Source: Microsoft Digital Defense Report, 2025
7,000+ password attacks blocked every second by Microsoft Source: Microsoft Digital Defense Report, 2025
$4.88 million global average cost of a data breach in 2024, an all-time high Source: IBM Cost of a Data Breach Report, 2024
22% of data breaches started with stolen or compromised credentials Source: Verizon DBIR, 2025
68% of breaches involved the human element (phishing, pretexting, misuse) Source: Verizon DBIR, 2025
The raw volume of cybercrime activity has reached a level that strains traditional concepts of enforcement. The following eight statistics quantify just how large the attack surface has become.
The FBI received 859,532 cybercrime complaints in 2024, averaging more than 2,350 reports every single day.
Source: FBI IC3 Internet Crime Report, 2024
Phishing, vishing, and smishing were the most frequently reported complaint categories filed with the FBI IC3 in 2024, continuing a multi-year streak as the top reported crime type.
Source: FBI IC3 Internet Crime Report, 2024
Microsoft blocked more than 600 million cyberattacks targeting its customers every day in the period covered by the 2025 Digital Defense Report.
Source: Microsoft Digital Defense Report, 2025
Microsoft intercepted more than 30 billion phishing emails in 2025, using AI-assisted detection and Safe Links analysis.
Source: Microsoft Digital Defense Report, 2025
88% of attacks against basic web applications used stolen credentials as the primary access method.
Source: Verizon DBIR, 2025
44% of all confirmed security incidents involved ransomware in the Verizon DBIR dataset.
Source: Verizon DBIR, 2025
The median time to click on a phishing link was 21 seconds from receipt of the message.
Source: Verizon DBIR, 2025
Infostealer malware detections surged significantly in 2024–2025, with the Verizon DBIR flagging it as a critical enabler of credential-based intrusions at enterprise scale.
Source: Verizon DBIR, 2025
The Financial Cost of Cybercrime
Behind every breach statistic is a dollar figure. The eight statistics below come from the most widely cited financial impact research in the industry: IBM’s annual Cost of a Data Breach study and the FBI’s Internet Crime Report.
The global average cost of a data breach reached $4.88 million in 2024, a 10% increase over the 2023 figure and the highest total in the study’s 19-year history.
Source: IBM Cost of a Data Breach Report, 2024
In the United States, the average breach cost was $9.36 million, more than double the global average and the highest of any country studied.
Source: IBM Cost of a Data Breach Report, 2024
Healthcare remained the costliest industry for the fourteenth consecutive year, averaging $9.77 million per breach in 2024.
Source: IBM Cost of a Data Breach Report, 2024
Detection and escalation was the single largest cost component of a breach, averaging $1.63 million, followed by lost business costs ($1.47 million), post-breach response ($1.14 million), and notification ($0.37 million).
Source: IBM Cost of a Data Breach Report, 2024
The average breach lifecycle was 258 days: 194 days to identify the breach and a further 64 days to contain it.
Source: IBM Cost of a Data Breach Report, 2024
58% of organizations increased the price of their products or services following a breach, passing costs directly to customers.
Source: IBM Cost of a Data Breach Report, 2024
Investment fraud was the costliest cybercrime category reported to the FBI in 2024, accounting for the largest share of the $16.6 billion total. Cryptocurrency fraud drove the majority of those losses.
Source: FBI IC3 Internet Crime Report, 2024
Business Email Compromise (BEC) losses reached approximately $2.77 billion in 2024, making it one of the top two costliest cybercrime categories even though its complaint volume is far lower than phishing.
Source: FBI IC3 Internet Crime Report, 2024
How Cybercriminals Break In: Attack Vectors
Understanding how attackers gain initial access is the first step toward stopping them. These nine statistics map the most common entry points documented in Verizon’s and IBM’s 2024–2025 research.
Stolen or compromised credentials were the most common initial attack vector, involved in 16% of all breaches studied by IBM in 2024.
Source: IBM Cost of a Data Breach Report, 2024
Phishing was the second most common initial attack vector at 15%, and it was also associated with the highest per-breach costs among all initial access methods.
Source: IBM Cost of a Data Breach Report, 2024
Cloud misconfiguration accounted for approximately 11% of initial attack vectors in IBM’s breach dataset.
Source: IBM Cost of a Data Breach Report, 2024
Business Email Compromise was the fourth most common initial attack vector in IBM’s 2024 breach study.
Source: IBM Cost of a Data Breach Report, 2024
68% of all confirmed data breaches involved the human element, employees clicking phishing links, falling for pretexting, or misusing access privileges.
Source: Verizon DBIR, 2025
In the median infostealer-infected account, only 49% of the victim’s stored passwords were unique. Half were reused across multiple services, giving attackers a ready-made credential-stuffing list.
Source: Verizon DBIR, 2025
The median time to enter data on a phishing site after clicking the link was 28 seconds, making human-based detection almost impossible in real time.
Source: Verizon DBIR, 2025
40% of breaches involved data stored across multiple cloud and on-premise environments, complicating both detection and containment.
Source: IBM Cost of a Data Breach Report, 2024
62% of professionals report always or mostly using the same password or a minor variation across accounts, directly enabling credential-stuffing at scale.
Source: LastPass Psychology of Passwords, 2022
🔒 Stop credential theft before it starts
Every stat above traces back to one root cause: reused, guessable, or stolen passwords. NordPass generates a unique, cryptographically random password for every account, stores them behind XChaCha20 encryption with a zero-knowledge architecture, and alerts you when a saved password appears in a breach. It is one of the few tools that directly addresses the attack vectors documented in Verizon DBIR and IBM’s research.
Affiliate link, we earn a commission at no extra cost to you. See our affiliate disclosure.
AI-Powered Attacks: The Emerging Threat
Artificial intelligence has crossed from the defender’s toolkit into the attacker’s. Microsoft’s threat intelligence team documented this shift in its 2025 report. These seven statistics describe where the line currently sits.
Nation-state actors from Russia, China, Iran, and North Korea are using large language models (LLMs) for cyberoperations, including generating phishing content, conducting vulnerability research, and writing malicious scripts, according to Microsoft’s tracking of these groups in 2024–2025.
Source: Microsoft Digital Defense Report, 2025
AI-generated phishing emails are described by Microsoft’s threat intelligence team as “nearly indistinguishable from legitimate messages,” with improved grammar, localized cultural references, and highly personalized targeting drawn from harvested social media data.
Source: Microsoft Digital Defense Report, 2025
Verizon DBIR 2025 flagged AI-assisted pretexting as an emerging factor in social engineering breaches, noting that high-quality deepfake audio and video are increasingly used in business email compromise and executive impersonation fraud.
Source: Verizon DBIR, 2025
AI is accelerating the credential-stuffing pipeline: automated tools now combine stolen password lists, AI-generated password variations, and residential proxy networks to test credentials at a rate impossible for human operators to manage manually.
Source: Microsoft Digital Defense Report, 2025
Defenders using AI and automation saved an average of $2.2 million per breach compared to organizations that had not deployed these technologies, the largest cost-reduction factor in IBM’s 2024 study.
Source: IBM Cost of a Data Breach Report, 2024
Organizations with full AI and security automation deployment contained breaches 98 days faster than those with no AI deployment, directly compressing the 258-day average breach lifecycle.
Source: IBM Cost of a Data Breach Report, 2024
Google’s Project Zero and Mandiant researchers documented AI-assisted vulnerability discovery by state-sponsored actors in 2024–2025, with LLMs used to rapidly analyze public codebases and identify exploitable logic flaws.
Source: Google Online Security Blog, 2025
📊 FBI IC3 2024: Cybercrime Losses by Category (Relative Share)
Investment Fraud
Largest
BEC / Email Fraud
~$2.77B
Tech Support Scams
~$1.46B
Personal Data Breach
~$1.3B
Ransomware
Growing
Total reported losses: $16.6 billion. Source: FBI IC3 Internet Crime Report 2024. Bar widths are proportional to reported losses; exact figures vary by subcategory definition.
Ransomware and Business Email Compromise
Two categories consistently dominate both the FBI and Verizon datasets when measuring financial damage: ransomware and business email compromise. Here are seven of the most important statistics from 2024–2025 covering both.
Business Email Compromise generated approximately $2.77 billion in reported losses in 2024, making it one of the highest-dollar cybercrime categories despite accounting for a fraction of total complaint volume.
Source: FBI IC3 Internet Crime Report, 2024
The average BEC attack in 2024 targeted a domestic wire transfer or payroll diversion, with attackers impersonating a CEO, CFO, or trusted vendor after compromising or spoofing a corporate email account.
Source: FBI IC3 Internet Crime Report, 2024
Ransomware was involved in 44% of Verizon DBIR 2025’s incident dataset, confirming it remains the most common final payload in financially motivated attacks.
Source: Verizon DBIR, 2025
The healthcare sector bore a disproportionate ransomware burden in 2024–2025, with the FBI and CISA warning that ransomware-as-a-service (RaaS) groups specifically target hospitals due to the urgency of restoring access to patient records.
Source: FBI IC3 Internet Crime Report, 2024; CISA, 2025
Stolen credentials are the most common enabler of both ransomware and BEC attacks. Attackers buy leaked usernames and passwords on dark-web markets and use them to access email systems, VPNs, and remote desktop services before deploying ransomware or redirecting wire transfers.
Source: Verizon DBIR, 2025; Microsoft MDDR, 2025
Recovery from a ransomware attack costs significantly more than the ransom itself. IBM’s 2024 study found that breaches where ransomware was the mechanism averaged $4.91 million in total costs, above the overall $4.88 million global average.
Source: IBM Cost of a Data Breach Report, 2024
The FBI IC3’s Recovery Asset Team (RAT) initiated the Financial Fraud Kill Chain in hundreds of BEC cases in 2024, successfully freezing a significant portion of fraudulent transfers before the funds left US financial institutions.
Source: FBI IC3 Internet Crime Report, 2024
What Defense Works: Security Effectiveness
With so much bad news in the data, it is worth isolating what the evidence actually says works. These six statistics come from IBM, Microsoft, and NIST and each represents a measurable, primary-source finding.
Multi-factor authentication blocks 99.9% of automated account-takeover attacks targeting Microsoft accounts, according to Microsoft’s analysis of identity attack data.
Source: Microsoft Digital Defense Report, 2025
Organizations with AI and security automation saved $2.2 million per breach on average, the single largest cost-reduction lever in IBM’s 2024 study, outperforming all other security investments measured.
Source: IBM Cost of a Data Breach Report, 2024
NIST SP 800-63B recommends screening every new password against lists of known-compromised passwords, requiring a minimum length of eight characters (with no upper limit below 64), and eliminating mandatory periodic resets that do not follow evidence of compromise.
Source: NIST SP 800-63B, 2017 (updated guidance 2024)
Breaches identified in under 200 days cost an average of $1.02 million less than breaches that took longer than 200 days to identify and contain.
Source: IBM Cost of a Data Breach Report, 2024
Involving law enforcement in a ransomware investigation saved organizations an average of $1 million per breach in IBM’s 2024 study, while also reducing the breach lifecycle by 16 days.
Source: IBM Cost of a Data Breach Report, 2024
36% of US adults, approximately 94 million people, now use a password manager, but more than half still rely on memory, browser storage, or handwritten notes, leaving a massive credential-hygiene gap.
Source: Security.org Password Manager Report, 2024
Frequently Asked Questions
How much money is lost to cybercrime each year?
The FBI’s Internet Crime Complaint Center (IC3) reported $16.6 billion in US cybercrime losses in 2024, a 33% increase from the $12.5 billion recorded in 2023. Investment fraud (largely cryptocurrency scams) was the costliest category, followed by business email compromise at roughly $2.77 billion. The IC3 total only counts crimes reported by US victims; the true global figure is a multiple of that.
What percentage of cyberattacks involve stolen passwords?
The 2025 Verizon DBIR found stolen or compromised credentials were the initial access vector in 22% of all confirmed data breaches. For attacks specifically against web applications, that figure rises to 88%. Microsoft blocks more than 7,000 password-related attacks every second, giving a sense of the raw volume of credential abuse occurring continuously.
How much does the average data breach cost in 2026?
IBM’s Cost of a Data Breach Report 2024 put the global average at $4.88 million per breach, an all-time high. The US average was $9.36 million. Healthcare was the most expensive sector at $9.77 million. These figures cover all costs: detection, notification, lost business, and post-breach response.
How are AI-powered cyberattacks different from traditional attacks?
AI lets attackers scale operations that previously required significant human labor. Nation-state groups documented by Microsoft are using LLMs to write hyper-personalized phishing lures, conduct vulnerability research, and generate malicious scripts faster than defenders can manually review them. Deepfake audio and video are now being used in BEC and executive impersonation fraud according to Verizon DBIR 2025. The attack surface has not fundamentally changed, but the speed and volume have increased substantially.
What is the most effective defense against cybercrime?
The evidence points to three primary interventions: multi-factor authentication (Microsoft data shows 99.9% block rate on automated account takeovers), AI-assisted detection and response (IBM found $2.2M savings and 98 days faster containment), and strong, unique passwords managed via a password manager (which directly addresses the credential-reuse pattern underlying 22% of all breaches and 88% of web application attacks).
