The FBI logged a record 1,008,597 cybercrime complaints and $20.9 billion in reported losses in 2025, and the average data breach now costs $4.99 million. Here are 40+ hacking and cybersecurity statistics covering attack frequency, costs, methods, and defense for 2026.
Key Hacking Statistics (2026)
- 1,008,597 cybercrime complaints and $20.9 billion in reported losses in 2025, both records (FBI IC3)
- Global cybercrime cost: $10.5 trillion in 2025, by one estimate (Cybersecurity Ventures)
- Average data breach cost: $4.99 million, up 12% and a record (IBM 2026)
- 31% of breaches started with vulnerability exploitation, overtaking stolen credentials for the first time (Verizon DBIR 2026)
- Median ransom payment: $769,000, down from $1 million a year earlier (Sophos 2026)
- Global information security spending: $213 billion (2025 forecast) (Gartner)
Cyberattack Frequency & Scale
| Statistic | Value | Source |
|---|---|---|
| Cybercrime complaints to the FBI (2025) | 1,008,597 | FBI IC3 |
| Phishing/spoofing complaints (2025) | 191,561 (19%, the most reported crime) | FBI IC3 |
| Ransomware complaints (2025) | 3,600+ | FBI IC3 |
| Breaches analysed in the DBIR | 22,000+ (from 31,000+ incidents) | Verizon DBIR 2026 |
| New malware and PUA samples/day | 450,000+ | AV-TEST |
| Hacker attacks on test computers (2007 study) | Every 39 seconds | U of Maryland |
Cost of Cybercrime
| Metric | Value | Source |
|---|---|---|
| Global cybercrime cost (2025 estimate) | $10.5 trillion | Cybersecurity Ventures |
| Average data breach cost | $4.99 million | IBM 2026 |
| US average breach cost | $11.5 million | IBM 2026 |
| Healthcare breach cost | $6.64 million (highest industry) | IBM 2026 |
| Reported US cybercrime losses (2025) | $20.9 billion (+26%) | FBI IC3 |
| Business email compromise losses (2025) | $3.05 billion | FBI IC3 |
| Median ransom payment | $769,000 | Sophos 2026 |
| Time to identify and contain a breach | 247 days | IBM 2026 |
| Information security spending (2025) | $213 billion | Gartner |
Attack Methods
| Finding | % of Breaches |
|---|---|
| Vulnerability exploitation as initial access | 31% (up from 20%) |
| Credential abuse as initial access | 13% (down from 22%) |
| Pretexting as initial access | 6% |
| Stolen credentials used at any stage | 39% |
| Ransomware present | 48% |
| Third party involved | 48% |
Website Hacking Statistics
- Phishing was the most common initial attack vector in IBM’s breach study for the fourth year running (IBM 2026)
- WordPress: 11,334 vulnerabilities in 2025, 91% in plugins (Patchstack)
- Median time to mass exploitation of a heavily targeted WordPress vulnerability: 5 hours
- Only 26% of CISA known-exploited vulnerabilities were fully remediated, and median patch time rose to 43 days (Verizon DBIR 2026)
For WordPress-specific data, see our detailed WordPress Hacking Statistics.
Key Takeaways
- Cybercrime keeps setting records. Over 1 million FBI complaints and $20.9 billion in reported losses in 2025. It’s not if, it’s when.
- The cost is staggering. $4.99M per breach on average, $11.5M in the US. Healthcare pays the most.
- Patch fast. Vulnerability exploitation is now the top breach entry point (31%), while phishing remains the most reported cybercrime. Patch quickly and train your team.
- Ransomware is everywhere. It appears in 48% of breaches, though median ransom payments fell to $769,000.
Sources
Frequently Asked Questions
How often do cyberattacks happen?
Constantly. The FBI received 1,008,597 cybercrime complaints in 2025, about 2,760 a day, and those are only the incidents people reported. Phishing and spoofing made up 19% of them. A widely quoted 2007 University of Maryland study found hackers attacked its test computers every 39 seconds.
How much does a data breach cost?
The global average is $4.99 million, according to IBM’s 2026 report. In the US it’s $11.5 million. Healthcare is the most expensive sector at $6.64 million per breach.
What is the most common type of cyberattack?
Phishing is the most reported cybercrime to the FBI (19% of 2025 complaints) and the most common initial attack vector in IBM’s breach study. In Verizon’s 2026 DBIR, though, vulnerability exploitation (31%) overtook credential abuse (13%) as the top way into confirmed breaches.
See also: Password Statistics and WordPress Hacking Statistics.
Was this article helpful?
YesNo
