How many cyberattacks occur in the US?
In 2025, the FBI’s Internet Crime Complaint Center received over 1 million cyberattack complaints, a new record. These attacks accounted for $20.9 billion in losses.
According to the most recent Internet Crime Report from the FBI, there were 1,008,597 cybercrime complaints in the United States in 2025. Over 3,200 of them were ransomware and data breach attacks on manufacturing, healthcare, and other critical infrastructure.
The number of reported cyberattacks was 17.3% higher than in 2024 (859,532), and financial losses rose 25.8%, up from $16.6 billion.
Cyberattacks have nearly tripled since 2018.
Cyberattack complaints reported to the FBI, 2018–2025
The FBI received over 6.0 million cyberattacks complaints between 2018 and 2025, with reported losses totaling $77.6 billion.
Financial losses from cyberattacks increased by 25.8% since 2024.
Financial losses from cyberattacks reported to the FBI, 2018–2025
Cyberattacks and cyber-fraud are a growing problem for both individuals and the government. Although these are a fraction of total crimes in the nation, the Government Accountability Office says the severe financial losses demonstrate the need for a robust law enforcement response.
What is a cyberattack?
The National Institute of Standards and Technology’s Computer Security Resource Center defines a cyberattack as “any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself.” This includes both technical attacks involving data breaches, as well as personal cons where the victim is communicating with the fraudster.
Types of cyberattacks include:
- Phishing/spoofing
- Data breaches
- Non-payment/non-delivery scams
- Malware
- Ransomware
- Distributed denial of service (DDoS) attacks
Phishing made up 19% of total cyberattacks in 2025.
Who monitors cyberattacks in the US?
The FBI leads national efforts to identify, prosecute, and reduce cybercrimes. These complaints are recorded and investigated by the FBI’s Internet Crime Complaint Center, also known as IC3.
In 2018, the US also established the Cybersecurity and Infrastructure Security Agency (CISA), responsible for defending the nation’s critical infrastructure from large-scale cyber attacks.
What cyberattacks are most common?
In 2025, the three most common cyberattacks reported were phishing, extortion, and investment fraud.
Investment fraud cybercrime, particularly using cryptocurrency, were the costliest, leading to $8.6 billion in losses.
Phishing is the most common cybercrime, but investment scams cause the most loss.
Reported cybercrimes by victim count and financial loss, 2024
Who is most affected by cybercrimes?
People older then 60 reported 37.1% of all financial losses from cybercrimes in 2025, the largest percentage among all age demographics.
They also made the most cybercrime complaints — 201,266 — 20% higher than the next highest cohort, adults age 40 to 49 (167,066).
Phishing is the most common cybercrime, but investment scams cause the most loss.
Cyberattack complaints and reported financial loss to the FBI, by age group, 2025
What is a cybersecurity threat?
Cybersecurity threats — such as ransomware, malware, and data breaches — aim to steal or damage data and disrupt digital systems.
IC3 received 3,237 reports from critical infrastructure organizations for ransomware and data breaches. There are 16 that the FBI considers critical infrastructure, meaning that their assets and operations are so vital to national security, the economy, and/or public heath that any attack on them would be debilitating to the country.
Ransomware hit healthcare the hardest, while information technology had the most data breaches.
Critical infrastructure ransomware and data breach complaints to the FBI, by sector, 2025
How to report a cyber attack
You can report internet-enabled crime against yourself or someone else via the Internet Crime Complaint Center. The IC3 processes complaints to determine their accuracy and completeness then investigates to return lost documents, information, and financial assets, if possible.
Where does this data come from?
Where does this data come from?
Data in this article comes from the FBI’s Internet Crime Complaint Center (IC3), which began tracking cybercrime complaints in the year 2000. Data in the report relies on public participation from individuals or organizations who have been targeted by cybercriminals to report, which means that not all cybercrimes are reported to the FBI. The FBI uses information gathered from IC3 to develop public awareness campaigns, alert the private sector, and to disrupt and deter cyberattacks.
Read more about crime in the US and get an array of government facts every week by signing up for our newsletter.
Keep exploring
- How much does text message fraud cost Americans? - In 2022, most text fraud reports of financial loss involved less than $1,000 — but over 88,000 reports involved losses of more than $10,000.
- How is crime measured in the US? - The FBI relied heavily on estimates for 2021 crime statistics due to low response rates from law enforcement agencies.
- How many spam phone calls do Americans receive? - In 2022, the government’s National Do Not Call Registry reported a five-year low in complaints about unwanted calls.
- What does the Cybersecurity and Infrastructure Security Agency (CISA) do?
