Cybersecurity & Data Breach Statistics 2026: $20.9B Stolen, 1M Hit | #cybercrime | #infosec

In 2025, cyber-enabled crime in the United States crossed a line no year had touched before: $20.9 billion in reported losses, logged across more than a million complaints. But that record total isn’t the real story. The bigger change is how the money disappears — criminals have largely stopped “hacking in” and started simply logging in, using stolen passwords, AI-built scams, and the vendors you already trust.

We’ve read a lot of “X billion stolen” headlines, and most miss the point. A scary total tells you the problem is big; it doesn’t tell you what changed. What changed in 2026 is the method: at nearly every major victim this year, the lock on the front door held — and the data still walked out, because someone handed over a key. That one idea explains almost every statistic below.

Overall cybercrime cost & breach landscape

The figure everyone quotes comes from the FBI’s Internet Crime Complaint Center, or IC3 — the federal clearinghouse where Americans report online fraud. The 2025 Internet Crime Report put losses at $20.9 billion, a 26% jump in a single year, and the first time the total has ever crossed $20 billion.

Here’s the part that should bother you more than the headline: that $20.9 billion is a floor, not a ceiling. Only about one in four scam victims ever files a report, so the true cost is almost certainly several times higher. When a dataset this incomplete is still setting records, the trend matters more than the total — and the trend is up 26% in a year.

Investment fraud did most of the damage at $8.6 billion, and crypto-related scams alone hit a record $11.36 billion. Business email compromise — BEC, where a criminal poses as a boss or supplier to redirect a payment — took another $3 billion. Older adults paid the steepest price: people over 60 lost $7.7 billion, up 37% in a year.

First half of 2026 (Early Actuals)

The first half of 2026 didn’t slow down. Global breaches rose 3% month over month in January, and attacks hit an all-time high of roughly 2,090 per organization each week, up 17%. Two patterns defined the opening months: an extortion crew called ShinyHunters tearing through corporate sales software, and a wave of healthcare breaches that began inside and outside vendors.

The scale is hard to overstate. ShinyHunters alone hit more than 40 organizations in 2026, and the wider campaign reportedly scraped around 1.5 billion records from over a thousand companies. The single biggest breach so far — the education platform Canvas — exposed roughly 275 million records. Put bluntly, a single extortion crew has out-stolen most national crime statistics this year.

The forecasts for the rest of 2026 aren’t comforting: AI-written phishing is expected to feature in 42% of all breaches by year-end, ransomware extortion damage is projected near $74 billion, and the global cost of cybercrime is heading toward $10.5–$10.8 trillion.

Full-year 2025 statistics

Zoom out to the full year, and the trend lines sharpen. The average data breach cost $4.44 million globally in 2025 — and here’s a rare piece of good news: it actually fell 9%, the first drop in four years, according to IBM’s Cost of a Data Breach report.

Don’t celebrate yet. The global average dropped only because more breaches happened in lower-cost regions — not because companies got safer. In the US, the average breach hit an all-time high of $10.22 million, more than double the global figure. Companies did get faster at catching intruders, cutting the average detect-and-contain time to 241 days, a nine-year low — though that’s still nearly eight months of an attacker living inside the network.

The raw volume is staggering. Verizon confirmed 5,176 breaches with verified data theft, Surfshark counted 425.7 million accounts exposed worldwide, and in the US alone, 166 million people were caught up in breaches in just the first half of 2025.

Six years of damage, side by side

The cleanest way to see the trajectory is to follow one consistent measure over time: the FBI’s IC3 has logged reported US losses every year, and the climb has been relentless. In just four years, the annual total roughly tripled — from $6.9 billion in 2021 to $20.9 billion in 2025.

The numbers reveal something the headline total hides. Complaints stayed remarkably flat — between roughly 800,000 and 880,000 from 2021 through 2024 — before finally crossing one million in 2025. Yet reported losses tripled over the same stretch, which means the money isn’t coming from reaching more victims; it’s being drained in far bigger amounts from each one. The average loss per complaint backs this up, climbing from about $14,200 in 2023 to $20,699 in 2025, as criminals shifted toward high-value investment and crypto scams that can wipe out six figures at a time.

One clarification, since these figures are easy to mix up: the IC3 total above measures all reported US fraud losses, while IBM’s often-quoted $4.44 million is the average cleanup cost of a single corporate breach, worldwide — a different scope entirely, which is why we keep the two apart. The IC3 line is the one that answers what most people are really asking — how much is being lost — and the answer climbs every single year.

How The Money Actually Gets Stolen

If you remember one thing from this report, make it this: a human being is involved in 82% to 95% of all breaches. The weak point usually isn’t the software — it’s a person clicking, trusting, or reusing a password. Here are the eight routes attackers lean on most.

Ransomware

Ransomware — malware that locks up your files until you pay — appeared in 44% of breaches in 2025, up from 32% the year before. That’s the biggest single-year jump on record in Verizon’s Data Breach Investigations Report, and the average ransomware breach now runs $5.08 million

The tactic is also mutating. Roughly half of attacks now skip the encryption entirely and just steal the data, then threaten to publish it — because backups can beat a lockout, but they can’t un-leak a file. The hopeful counter-trend: more victims are saying no. The share that paid fell from 41% to 36%, and 86% of businesses refused in 2025.

Social engineering & phishing

Phishing — tricking someone into handing over a password or clicking a malicious link — is getting a frightening upgrade from AI. Criminals now generate flawless, personalized lures at scale, and those AI-written messages lift click rates by up to 54%. By late 2026, AI phishing is projected to drive 42% of all breaches.

The 2026 wave leaned hard on “vishing” — voice phishing, where someone calls pretending to be IT support and talks an employee out of a login. That one phone call trick opened the door at Charter, CarGurus, and Crunchbase. No malware required.

Stolen credentials & identity-based attacks

This is the heart of the “log in, don’t break in” story. Stolen or reused passwords were behind 53% of breaches in 2025, at $4.81 million each. And 88% of the time, the attacker simply signed in as a legitimate user — no alarm, no exploit, because a valid password looks exactly like a valid password. These breaches also take the longest to catch, about 328 days. If you’re modeling next year’s risk, credentials, phishing, and ransomware belong in one bucket — that’s where every curve is bending.

Vulnerability exploitation

Unpatched software flaws caused 20% of breaches at $4.24 million apiece. The worrying detail: in Verizon’s 2026 data, exploiting a known flaw has overtaken stolen passwords as the single most common way in. Companies still take a median of 55 days to fix a hole they already know about — plenty of time for an attacker who’s already watching.

Supply chain & third-party attacks

Third-party involvement doubled in a year to 30% of breaches, and supply-chain attacks cost $4.91 million. The uncomfortable lesson of 2026 is that you can harden your own systems perfectly and still get breached through a vendor you don’t control. Two major US banks, Citizens and Frost, were hit on the same day through one shared supplier.

AI-powered attacks

For the first time, the IC3 tracked AI as a distinct threat: more than 22,000 complaints and over $893 million in losses tied to criminal use of AI. Attackers used AI in 16% of breaches, including AI-written phishing (37%) and deepfake impersonation (35%). Little wonder that 94% of security leaders now call AI the biggest force reshaping their field.

Cloud misconfiguration

As companies moved to the cloud, attackers followed — cloud intrusions jumped 26% in a year. A newer blind spot is “shadow AI,” where employees paste sensitive data into unapproved AI tools. One in five organizations reported a shadow-AI breach, at $4.63 million each, and most of those leaked customer data.

Insider threats

Insiders were behind 30% of breaches, and the malicious kind cost $4.92 million. The defining example came from inside a contractor: at the crypto exchange Coinbase, bribed support agents at an outsourcing firm photographed customer records — one reportedly snapping up to 200 a day and selling them for about $200 each.

Where Data Breach Hit Hardest (Industry Impact)

Average breach costs are useful and misleading in equal measure. That tidy $4.44 million global mean hides a near-3x spread between sectors, and the real 2026 story is that ‘industry’ is being replaced by a simpler predictor: whoever holds the most reusable personal data is next.

Healthcare

Healthcare has now topped the breach-cost ranking for fifteen straight years, at $11.2 million per incident — about 2.5 times the global average. A 15-year streak at the top of a cost ranking isn’t bad luck; it’s structural. The math is simple for a criminal: medical records are worth far more than a credit card number, and a hospital under attack can’t afford downtime. In 2025, healthcare logged more cyberattacks than any other critical sector.

Financial services

Banks and insurers came second at $6.08 million per breach, and they’re the most-phished sector of all — financial firms absorbed 18.3% of phishing attacks in mid-2025. Deep pockets and instant payments make them an obvious mark.

Manufacturing

Factories rarely make headlines, but they top the ransomware charts. Manufacturers run “operational technology” — the machines on a production line — and a stopped line bleeds money every minute, so they’re under maximum pressure to pay fast, which is exactly why attackers prize them. They filed about a third of all 2025 cyber-insurance claims.

Education

Schools and universities are cheap to breach and rich in data. The Canvas breach — about 275 million records — became the largest education hack ever recorded. It doesn’t help that two-thirds of US K-12 districts have no dedicated cybersecurity staff at all.

Government & public sector

Government agencies were among the top ransomware targets in 2025. In 2026, a French ID agency lost 11.7 million citizens’ records, and US state social-services systems exposed roughly a million more — the kind of official data that makes impersonation terrifyingly convincing.

Retail & e-commerce

Anywhere customer data piles up, attackers follow. The ShinyHunters campaign tore through retail and luxury brands, hitting CarGurus (12 million-plus), Carnival (6 million), and names like Adidas, Chanel, and Pandora.

Small & medium-sized businesses

Here’s the myth worth killing: “We’re too small to target.” In reality, ransomware shows up in 88% of small-business breaches versus 39% at large firms, and 43% of all attacks aim at small and medium-sized businesses. The average small-business breach costs $3.31 million — and roughly 60% of small firms that get hit close within six months. Yet only about 17% carry cyber insurance.

The Numbers Don’t Tell the Same Story Twice

Financial services leads in breach volume at 22.2% of all confirmed U.S. compromises in 2025, yet it sits second in per-incident cost at $5.56 million. Healthcare runs the inverse: just 16.1% of breach volume, but the highest cost on record at $7.42 million per incident. High frequency doesn’t mean serious damage. Low frequency doesn’t mean low risk. The donut chart and the cost chart appear to contradict each other — and that tension is the point. 

The gap comes down to data type. A financial firm gets hit often because it’s an obvious target — but the industry has mature playbooks, and most incidents are contained. A hospital breach carries protected health information that can’t be reissued like a credit card, triggers mandatory HIPAA reporting, and unfolds in an environment where downtime is a patient safety event. That’s what $7.42 million actually buys.

Manufacturing is the quiet outlier: 9% of breach volume, yet responsible for roughly a third of all 2025 cyber-insurance claims. Ransomware against a production line has an hourly cost that no other sector matches. Education looks cheap at $3.80 million per incident — until one attack on shared infrastructure, like the Canvas breach at 275 million records, rewrites the sector’s entire loss profile overnight.

The takeaway is simple: breach count tells you who attackers target most often. Breach cost tells you who bleeds most when they succeed. The sectors running the most dangerous combination of moderate volume, high unit cost, and low insurance coverage — healthcare and manufacturing — are also the ones least able to absorb the hit.

Major Cybersecurity & Data Breach Incidents

Statistics stay abstract until you watch them happen. Ranked by total damage — biggest first — here are the breaches that defined 2025 and 2026, with what each cost and how much has actually been contained. Don’t read record counts as final damage: the dollar figures lag by months, so Coinbase’s ‘70,000 customers’ is maturing into a $400 million cleanup. The metric that matters is the gap between disclosure and containment — a paid ransom suppresses a leak but never guarantees deletion, and biometric or government-ID data, once out, can’t be remediated at all.

ShinyHunters Salesforce / Microsoft 365 campaign

The single biggest story of these two years isn’t one breach but one operation. ShinyHunters, a financially motivated extortion crew, abused corporate sales software (Salesforce), a login-sharing standard called OAuth, and old-fashioned help-desk phone calls to scrape an estimated 1.5 billion records from more than 1,000 organizations — Google, Workday, Cisco, Qantas, and Chanel among them. Damage contained: only partly. French police arrested four alleged members in June 2025, yet the campaign kept running. Most of the individual breaches below are branches of this same tree, which is why ‘how many companies’ matters less than ‘how many shared the same weak link.’

Instructure / Canvas — 275 million records

ShinyHunters claimed 3.65 terabytes and roughly 275 million records from Canvas, the learning platform used by nearly half of North American universities, and defaced login pages at about 330 schools. It’s the largest education-sector breach ever recorded. Remediation: Instructure paid a ransom on May 11 to suppress the leak and locked down the affected portals, but paying halts publication; it never guarantees the copies are gone.

France’s ANTS — 11.7 million citizens 

The French agency that issues national IDs, passports, and driver’s licenses confirmed 11.7 million accounts breached, with the attacker claiming up to 19 million. Remediation: ANTS pulled its portal offline on April 24 and opened an investigation. There’s no ‘reset’ for a citizen’s ID record, so this damage is effectively permanent — it will fuel impersonation for years.

Carnival — 6 million customers 

One socially engineered employee account exposed about 6 million cruise customers (ShinyHunters claimed 8.7 million), including passport and driver’s license numbers. Remediation: Carnival offered 24 months of credit monitoring — a standard but limited fix, since durable IDs like passports can’t simply be reissued on demand.

Charter / Spectrum — 4.9 million customers

A single vishing call compromised an employee’s Microsoft login and led to 4.9 million customer records leaking from the company’s sales software (ShinyHunters claimed 42 million). Remediation: Charter refused to pay — and the data was published anyway. ‘Don’t negotiate’ is the principled choice, but it isn’t a painless one.

Citizens & Frost Bank — 3.4 million-plus 

Two major US banks were breached on the same day through one shared vendor, with the Everest ransomware crew posting the stolen files. The haul included 3.4 million records from Citizens and more than 250,000 Social Security and tax ID numbers, W-2s, and health savings data from Frost. Remediation: both filed breach notifications with state regulators, but the shared-vendor root cause means the real fix sits partly outside either bank’s control.

NYC Health + Hospitals — 1.8 million, including fingerprints 

Smaller in count, off the charts in severity. The largest US public health system confirmed a breach affecting at least 1.8 million people through an outside vendor, not its own network. Alongside medical records, attackers took fingerprints and palm prints, as TechCrunch reported. Remediation: notifications and an investigation are underway, but this is the rare breach with damage that can’t be remediated at all — you can reissue a Social Security number under extreme circumstances, but you can never reissue a fingerprint.

Coinbase — 70,000 customers, up to $400 million in cost 

Smallest record count here, biggest price tag. Bribed overseas support agents at an outsourcing firm stole data on about 70,000 Coinbase customers. Remediation: Coinbase refused the attackers’ $20 million ransom, posted a matching $20 million bounty for information leading to their arrest, and committed to reimbursing affected customers, with total cleanup estimated at $180–$400 million. The irony worth sitting with: this crypto exchange was never hacked ‘on-chain’ — it was an old-fashioned inside job, used to power downstream scams.

Other notable 2025–2026 incidents

The pattern repeated across sectors: Medtronic (up to 9 million records claimed), Adobe (13 million support tickets), Match Group (10 million), Nike (1.4 terabytes of internal IP), Navia (2.7 million health records), Marquis Health (780,000), and a ransomware hit on the University of Hawaiʻi (1.2 million)—different names, same root cause — trusted access, abused.

The most uncomfortable insight from this chart isn’t the size of any individual bar — it’s the disconnect between what gets measured and what actually matters.

Financial damage figures capture what organizations spent responding to a breach. They don’t capture what the data will cost the people whose records were taken. ShinyHunters’ $960 million looks like the biggest number until you remember it’s distributed across more than a thousand companies, each absorbing a manageable slice. The real concentration of harm sits lower on the chart: France ANTS at $80 million represents 11.7 million citizens whose passport and ID records are permanently in circulation, and NYC Health + Hospitals at $200 million includes 1.8 million fingerprints that can never be reissued. Those figures will stop growing on a balance sheet. The identity fraud they enable won’t.

The other pattern the chart reveals: paying or refusing to pay barely changes where you end up. Charter refused, and the data was published. Carnival paid for credit monitoring; litigation is still coming. Coinbase refused, offered a bounty, and is still staring at $400 million in cleanup. The breach cost is largely fixed the moment the data leaves the building. Everything after that is damage control, not damage prevention.

The defender shortage nobody’s fixing

Here’s a number that explains why so many attacks succeed: the world is short about 4.8 million cybersecurity workers — a record gap that grew 19% in a year, per the ISC2 Cybersecurity Workforce Study. To meet demand, the workforce would have to grow by 87%. This shortage is the multiplier on every breach cost above: understaffed teams detect slower and contain less.

And the cause shifted in 2025. For the first time, the top reason for understaffing wasn’t a talent shortage — it was budget cuts. A third of organizations say they can’t afford to staff their security teams properly. Skills gaps can be trained away over time; cutting security budgets during a record surge in threats is a deliberate choice — and it costs about $1.76 million more per breach.

Response Measures & Actions Already Taken

Money is pouring into defense. The AI-driven security tools market will top $133 billion by 2030. Meanwhile, “zero trust” — a model that verifies every user and device by default — has become a $48 billion market in its own right. Enforcement is ramping up alongside it. The FBI’s Operation Level Up has cut potential crypto-scam losses by more than $500 million since 2024. Europe issued nearly €1.2 billion in GDPR fines in 2025. In addition, US public companies must now disclose serious breaches within four business days.

What the data says about what actually works

IBM’s research is unusually detailed on this point. A tested incident-response plan cuts breach costs by $2.66 million on average. That makes it the single biggest lever of any security control measured. For most industries near the $4.44 million global average — retail, education, hospitality, transportation — that one measure alone reduces residual exposure to under $2 million. Furthermore, AI and automation add another $1.9 million in savings and compress detection time from 241 days to 51. Zero trust contributes $1.76 million more. Stack all three, and the combined savings of $6.32 million exceed the global average breach cost entirely.

Where the gap between industries matters most

The chart makes one contrast especially clear. Healthcare carries $1.10 million in residual cost even after applying all three measures. HIPAA penalties, biometric data exposure, and a 279-day average dwell time create a structural cost floor. No playbook eliminates that entirely. Financial services at $5.56 million, however, reaches near-zero residual after stacking all three. That suggests high finance costs reflect incident frequency and scale — not irreducible structural exposure. For the nine industries clustered between $2.86 million and $4.43 million, full deployment of these measures would arithmetically wipe out most direct breach costs. Consequently, underinvestment in any of them is difficult to justify on financial grounds.

The safety net is getting more expensive

After two soft years, cyber insurance premiums will climb 15–20% in 2026. Ransomware drives roughly 60% of large claims. The gap hits small businesses hardest. Only 17% carry cyber insurance, and an uninsured incident averaging $79,000 is often fatal for a small firm. Importantly, the three measures above are not exclusively enterprise tools. A tested IR plan costs time, not infrastructure. Zero trust rolls out incrementally. Therefore, the data makes one thing clear: the cheapest breach is the one an organization already knows how to respond to.

The Critical Importance of Proactive Security Measures

If there’s a single takeaway from the 2026 data, it’s that speed and preparation pay for themselves. A breach caught and contained in under 200 days costs $3.87 million; let it run past 200 days, and the bill jumps to $5.01 million. Every extra day an attacker stays hidden adds to the tab.

The cheapest defenses are also the most boring: a written response plan, MFA on every account, and encryption that travels with the data so a stolen file is useless without the key. Across nearly every 2026 incident, the same lesson repeats — the walls held, but the data was readable the moment someone reached it. The companies that suffered least weren’t the ones with the highest walls. They were the ones whose data was worthless once stolen.

FAQs

How much money is stolen in data breaches and cybercrime in 2026?

US-reported cyber-enabled crime losses hit $20.9 billion in 2025 — a floor, since roughly three in four victims never report — and global cybercrime cost is projected at $10.5–$10.8 trillion in 2026. The average data breach cost $4.44 million globally, and $10.22 million in the US.

What’s the most common cause of data breaches in 2026?

People. A human is involved in 82–95% of breaches, led by stolen credentials (53% of cases) and social engineering. Ransomware appears in 44% of breaches, and exploiting known software flaws has become the top single way in.

Which industry has the highest breach costs?

Healthcare, at $11.2 million per breach — the highest for 15 straight years — followed by financial services ($6.08 million) and critical infrastructure ($4.82 million).

How long does it take to detect a breach?

241 days on average in 2025 (181 to spot it, 60 to contain it), a nine-year low. Companies using AI and automation cut that to about 51 days.

Are small businesses really targeted?

Yes. 43% of all attacks target small and medium-sized businesses; ransomware appears in 88% of their breaches; only about 17% carry cyber insurance; and roughly 60% are hit within six months.

References