The Biggest Cyber Attacks in the Last 5 Years: 2026 Rankings by Cost, Scale & Industry

In September and October 2026, the Inovo InfoSec research team analyzed 48 published sources to rank the most significant cyber attacks from January 2021 through October 2026. The core data comes from three annual studies: IBM's 2026 Cost of a Data Breach Report, which covered 602 breaches across 17 industries¹; Verizon's 2026 Data Breach Investigations Report, which reviewed more than 22,000 confirmed breaches³; and the FBI's 2025 Internet Crime Report, built on more than 1 million complaints⁴. We paired these with government notices, company disclosures and incident reporting for 14 major attacks. An attack qualified if it ranked in the top tier on at least one measure: people or records affected, direct cost or loss, or disruption across a whole sector. All costs appear as reported at the time and are not adjusted for inflation.

The Biggest Cyber Attacks in the Last 5 Years, Ranked

The table below lists the 14 most significant cyber attacks from 2021 through October 2026, measured by people or records affected, reported cost, or disruption across a sector.

Key takeaways:

• Ransomware, extortion or data theft drove 11 of the 14 attacks; only two, Bybit and Salt Typhoon, were nation-state operations.

• Basic control gaps recur: Change Healthcare's attackers entered through a Citrix portal without MFA¹⁸, and Snowflake blamed customer data losses on accounts that did not use MFA²¹.

• The Defense Manpower Data Center stored SSNs unencrypted, and unauthorized users had access for about nine months⁵, the kind of exposure CMMC is designed to close.

• Four of the 14 reached victims through shared software or a third-party platform: Kaseya, Log4Shell, MOVEit and Snowflake.

• The costliest events hurt through downtime: the Cyber Monitoring Centre found no evidence of a ransom demand behind JLR's losses and said nearly all of the damage came from operational disruption¹².

Ranked by Cost

Reported costs measure different things, so the table below labels what each figure represents.

Table 1A: The Most Expensive Cyber Attacks of the Last 5 Years

Rank	Attack	Year	Cost or loss	What the figure measures
1	Change Healthcare	2024	About $3.1B19	Parent company's reported costs
2	Jaguar Land Rover	2025	About £1.9B ($2.55B)11	UK economy-wide loss, mostly lost output at JLR and its suppliers11
3	Bybit	2025	About $1.5B14	Crypto assets stolen
4	Marks & Spencer	2025	About £300M11	Company's estimated cost
5	Kaseya VSA	2021	$70M27	Ransom demanded (not a loss figure)
6	Change Healthcare ransom	2024	$22M20	Ransom paid
7	Colonial Pipeline	2021	About $4.4M28	Ransom paid (75 BTC)
Modeled	MOVEit Transfer	2023	About $15.8B25	Emsisoft estimate at $165 per record; not a reported loss

Key takeaways:

• Change Healthcare and Jaguar Land Rover together top $5.6B, and both losses were driven by operational shutdown, not the ransom.

• Ransoms are small next to total cost: Change Healthcare's $22M payment²⁰ was less than 1% of its $3.1B bill¹⁹.

• MOVEit's $15.8B figure is a model, not a reported loss, so it sits outside the ranking.

Ranked by People or Records Affected

The table below ranks the largest attacks by confirmed people or records exposed and names the type of data taken.

Table 1B: The Largest Cyber Attacks by People or Records Affected

Rank	Attack	Year	People or records	Data exposed
1	National Public Data	2024	2.9B records (not unique people)24	Names, addresses, SSNs47
2	Change Healthcare	2024	192.7M people17	Insurance member IDs, diagnoses, treatment details, SSNs17
3	AT&T (Snowflake)	2024	About 110M customers21	Call and text records21
4	MOVEit Transfer	2023	95.8M people25	Varies by victim organization
5	DentaQuest	2026	15M people7 (possibly 23.4M8)	Personal and dental health information8
6	Defense Manpower Data Center	2026	3.05M people5	SSNs and military personnel data6
Claimed	Instructure (Canvas)	2026	About 275M records claimed by attackers; not confirmed9	Names, email addresses, teacher and student messages9

Key takeaways:

• Change Healthcare remains the largest healthcare data breach in US history¹⁸.

• Two of the six confirmed entries are health or health-benefits companies, which hold data such as diagnoses and insurance IDs that cannot be reissued like a password.

• National Public Data's 2.9B figure counts records, including duplicates, so it should not be read as 2.9B people²⁴.

Biggest Cyber Attacks in the Last 5 Years by Type

Grouping the biggest attacks by type shows which methods caused the most damage and how common each one is across all breaches.

Table 2: Major Cyber Attacks by Type, 2021 to 2026

Attack type	Biggest examples (Table 1)	Key metric
Ransomware	Change Healthcare, Colonial Pipeline, Kaseya	Present in 48% of breaches (2026 DBIR)2
Third-party and supply chain	Kaseya, MOVEit, Log4Shell, Snowflake	Third party involved in 48% of breaches, up 60% in a year3
Vulnerability exploitation	MOVEit, Log4Shell, DMDC	Top way in at 31% of breaches; credential abuse fell to 13%3
Data theft and extortion	Instructure, DentaQuest, National Public Data	41% of ransomware attacks targeted brand reputation through public shaming and media leaks1
Nation-state	Bybit, Salt Typhoon	Espionage motive in 17% of breaches (2025 DBIR)29
DDoS	None reached Table 1	47.1M attacks mitigated in 2025, up 121%; record 31.4 Tbps attack32

Key takeaways:

• Ransomware and third-party involvement each appear in nearly half of all breaches, and most of the biggest attacks combined the two.

• DDoS leads by volume but caused none of the 14 biggest incidents; the real disruption and data loss came from intrusions.

• Nation-state attacks are rare but outsized, as Bybit's roughly $1.5B theft shows¹⁴.

• The same methods reach mid-market firms, which is why frameworks such as CMMC and SOC 2 put so much weight on patching, MFA and vendor controls.

Most Common Attack Type by Year

The table below tracks how breach patterns changed across six editions of Verizon's Data Breach Investigations Report (DBIR).

Key takeaways:

• Ransomware's share of breaches rose almost fivefold, from 10% to 48%, across six DBIR editions.

• The 2026 edition is the first in which exploiting unpatched software overtook stolen credentials as the top way in.

• The human element fell partly because Verizon changed its definition in 2024; on the old basis, that year would have been about 76%²⁹.

Fastest-Growing Attack Types

The table below compares each trend's earlier and latest readings to show which threats are growing fastest.

Table 2B: Fastest-Growing Cyber Threats

Trend	Earlier	Latest	Change
Breaches involving a third party	15% (2024 DBIR)29	48% (2026 DBIR)29	More than 3x
Ransomware share of breaches	10% (2021 DBIR)29	48% (2026 DBIR)29	About 5x
Shadow AI incidents	20% (2025)1	43% (2026)1	More than 2x
DDoS attacks mitigated	2024 baseline	47.1M (2025)32	Up 121%32
AI-driven attacks	2025 baseline	More than 1 in 4 organizations hit (2026)1	Up 56%1
Vulnerability exploitation as the way in	20% (2025 DBIR)29	31% (2026 DBIR)29	Up 11 points

Key takeaways:

• Third-party risk is the fastest-growing breach factor Verizon tracks, tripling in three editions.

• One compromised vendor reached up to 1,500 businesses in the Kaseya attack²⁷ and 2,773 organizations in the MOVEit attack²⁵.

• AI is now a measurable cost driver: IBM found AI-driven attacks added about $1M per incident¹.

Biggest Cyber Attacks by Industry

Every major sector suffered at least one landmark attack in the last five years. The table below pairs each attack with the framework that now shapes how that sector is expected to defend itself.

Table 3: The Biggest Cyber Attack in Each Sector, 2021 to 2026

Sector	Biggest attack	Year	Scale	Framework that applies
Healthcare	Change Healthcare	2024	192.7M people17; about $3.1B19	HIPAA, HITRUST
Defense and government	Defense Manpower Data Center	2026	3.05M people; exposed about 9 months5	CMMC, NIST SP 800-171
Manufacturing	Jaguar Land Rover	2025	About £1.9B UK cost; 5,000+ organizations affected11	CMMC (defense suppliers), ISO 27001
Finance	Bybit	2025	About $1.5B stolen14	SOC 2, ISO 27001
Technology and SaaS	Snowflake customer campaign	2024	165 customers; about 110M AT&T customers21	SOC 2, ISO 27001
IT and MSPs	Kaseya VSA	2021	60+ customers, mostly MSPs; up to 1,500 businesses27	SOC 2, CMMC (for MSPs serving the defense industrial base)
Telecom	Salt Typhoon	2024	9 US carriers; victims in 80 countries22	NIST CSF
Retail	Marks & Spencer	2025	About £300M11	ISO 27001
Energy and critical infrastructure	Colonial Pipeline	2021	5,500-mile pipeline shut down28	NIST CSF
Education	Instructure (Canvas)	2026	30M+ active users on the platform10; about 275M records claimed by attackers9	NIST CSF

Key takeaways:

• No sector was spared: all 10 had an incident large enough to make national news.

• Healthcare and defense operate under mandated frameworks, yet they produced two of the most serious exposures, so a mandate on paper is not the same as controls in place.

• MSPs act as force multipliers for attackers: one Kaseya compromise reached up to 1,500 businesses²⁷.

• Healthcare organizations answer to HIPAA, defense contractors and their manufacturing suppliers to CMMC, and SaaS companies, financial firms and MSPs to SOC 2 and ISO 27001. This is where Inovo InfoSec's CISO-led readiness, remediation and ongoing management work sits.

Most-Targeted Industries

The table below ranks the US critical infrastructure sectors most targeted in 2025, based on complaints reported to the FBI's Internet Crime Complaint Center (IC3).

Table 3A: Most-Targeted Critical Infrastructure Sectors in the US (FBI IC3, 2025)

Rank	Sector	Evidence
1	Healthcare and public health	460 ransomware attacks and 182 data breaches (642 total), the most of any sector4,34
2	Critical manufacturing	Second-most targeted4; among the sectors top ransomware variants such as Akira and Qilin hit hardest33
3	Financial services	Third-most targeted, with 447 total cyber events34; second-costliest breaches at $6.29M (IBM 2026)1
4	Information technology	Fourth-most targeted4
5	Government facilities	Fifth-most targeted4

Key takeaways:

• Healthcare led all 16 critical infrastructure sectors for ransomware and breaches in 2025.

• Critical manufacturing, the backbone of the defense industrial base, ranked second, which is the core case for CMMC readiness among suppliers.

• IC3 counts only what victims report, and its ransomware loss figures exclude business disruption and remediation costs⁴, so the true impact is higher.

Average Breach Cost by Sector

The table below shows how average breach costs moved in the two highest-cost sectors over the last three IBM reports.

Table 3B: Average Data Breach Cost by Sector, 2024 to 2026 (IBM)

Sector	2024	2025	2026
Healthcare	$9.77M35	$7.42M48	$6.64M1
Financial services	$6.08M35	$5.56M1	$6.29M1
US average (all sectors)	$9.36M36	$10.22M37	$11.5M1
Global average (all sectors)	$4.88M35	$4.44M37	$4.99M1

Key takeaways:

• Healthcare has had the costliest breaches for 13 straight years¹, though its average fell 32% from 2024 to 2026.

• Financial services costs rose 13% in 2026, with IBM linking much of the increase to AI-related attacks¹; energy followed at about $5.24M³⁷.

• A US company now pays more than double the global average per breach: $11.5M in 2026¹.

The Cost and Impact of the Biggest Cyber Attacks

The real cost of a major attack shows up in downtime and recovery, not the ransom. The table below shows what the biggest incidents cost and how long operations were disrupted.

Table 4: Financial Cost and Downtime of the Biggest Incidents

Attack	Cost or loss	Downtime or disruption	Ransom paid?
Change Healthcare (2024)	About $3.1B19	Claims processing disrupted for patients and providers nationwide17	Yes, $22M20
Jaguar Land Rover (2025)	About £1.9B UK economic cost11	About 5-week production halt at 3 UK plants; about 5,000 vehicles lost per week12	No evidence of a ransom demand found by the CMC12
Bybit (2025)	About $1.5B stolen14	Exchange said it would use a bridge loan if needed to keep user funds available16	Theft, no ransom
Marks & Spencer (2025)	About £300M11	Online services disrupted about 2 months11	Not disclosed
Kaseya VSA (2021)	$70M ransom demanded27	Most of the 800 Coop supermarkets in Sweden closed when cash registers failed27	Not reported
Colonial Pipeline (2021)	About $4.4M ransom28	5,500-mile pipeline shut, stopping fuel flow from the Gulf Coast to the East Coast28	Yes, 75 BTC; DOJ recovered $2.3M28

Key takeaways:

• Operational shutdown, not data loss, drove the two largest bills: Change Healthcare and Jaguar Land Rover.

• JLR's losses spread to more than 5,000 UK organizations, including suppliers and dealerships¹¹.

• Paying did not prevent the damage: Colonial and Change Healthcare both paid and still faced major disruption.

• Downtime is the cost line most mid-market firms underestimate, and a tested incident response plan with reliable backups is what shortens it.

Average Data Breach Cost, 2021 to 2026

The table below tracks IBM's average breach cost across six report years, globally, in the US and in healthcare.

*Note: IBM's 2022 report put the healthcare average at $10.10M, a 9.4% rise over 2021⁴⁰; the 2021 figure shown is calculated from that change.

Key takeaways:

• The global average hit a record $4.99M in 2026, up 18% from $4.24M in 2021.

• US breach costs rose 27% over the same period, from $9.05M to $11.5M.

• Detection speed is a direct cost lever: breaches contained within 200 days averaged $4.32M, versus $5.65M for those that ran longer¹.

Ransom Payouts

The table below compares total ransom payments tracked on the blockchain with total cybercrime losses reported to the FBI.

Table 4B: Ransom Payments and Reported Cybercrime Losses by Year

Year	Total ransomware payments (Chainalysis)	Reported cybercrime losses (FBI IC3)
2025	About $820M (preliminary)41	$20.9B4
2024	$892M (revised from $813M)41	$16.6B4
2023	$1.1B, a record as first reported43*	$12.5B45
2022	$567M43	$10.3B44
2021	$983M43	$6.9B44

*Note: Chainalysis revises its totals upward as it traces more payments; its 2024 total, for example, grew from an initial $813M to $892M⁴¹. The 2023 figure may be higher in later reports.

Key takeaways:

• Ransom payments have fallen from their 2023 peak even as attacks rose, and Verizon found that 69% of ransomware victims refused to pay in 2026²⁹.

• Attackers are going after bigger targets: the median payment rose from $12,738 in 2024 to $59,556 in 2025⁴¹.

• Total cybercrime losses reported to the FBI tripled from 2021 to 2025, reaching $20.9B⁴.

What the Biggest Attacks in the Last 5 Years Mean for Your Business

The biggest attacks of the last five years trace back to three repeat gaps, not exotic exploits. The first is missing MFA: Change Healthcare's attackers entered through a Citrix portal without it¹⁸, and the Snowflake campaign succeeded against accounts that did not use it²¹. The second is unpatched software: MOVEit and Log4Shell showed how one flaw can reach thousands of organizations, and exploitation is now the top way into a breach at 31%³. The third is third-party access: Kaseya, MOVEit and Snowflake all reached victims through a vendor, and third parties now appear in 48% of breaches³.

Frameworks such as CMMC, SOC 2, HIPAA and ISO 27001 exist to close exactly these gaps, by requiring strong authentication, timely patching and real oversight of vendors. Inovo InfoSec applies them through its ARM approach: Assess current risks and gaps, Remediate them with prioritized controls and policies, and Manage compliance year-round so the program holds up after the audit.

Book a Discovery Call to talk through your gaps with a CISO-led advisor, or Request a Free Compliance Assessment to see where your organization stands today.

References

1. Baker Donelson, Ten Takeaways from IBM's 2026 Cost of a Data Breach Report

2. Verizon, 2026 Data Breach Investigations Report

3. SecurityWeek, Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector

4. HIPAA Journal, 2025 Losses to Cybercrime Exceeded $20 Billion (FBI IC3)

5. BetaNews, Pentagon Database Flaw Exposed Social Security Numbers of More Than 3 Million People

6. Military Times, Military Personnel Data Exposed in Breach, Agency Warns

7. HLTH, DentaQuest Data Breach Affects More Than 15 Million People

8. SecurityWeek, DentaQuest Data Breach Potentially Impacts Over 23 Million People

9. TechCrunch, Hackers Steal Students' Data During Breach at Education Tech Giant Instructure

10. Yahoo Tech, Instructure Pays Ransom to ShinyHunters After Canvas Data Breach

11. Basis Point, JLR Hack Costs UK Economy £1.9 Billion, Affects Over 5,000 Firms: Report

12. NFDA, JLR Cyber-Attack Most Financially Damaging in UK History (Cyber Monitoring Centre findings)

13. ITV News (PA), M&S Hackers Claim to Be Behind Jaguar Land Rover Cyber Attack

14. FBI, PSA I-022625-PSA: North Korea Responsible for $1.5 Billion Bybit Hack

15. NBC News (Reuters), FBI Says North Korea Was Responsible for $1.5 Billion ByBit Hack

16. Security Affairs, FBI: North Korea-Linked TraderTraitor Is Responsible for $1.5 Billion Bybit Hack

17. Reuters via AOL, Hack at UnitedHealth's Tech Unit Impacted 192.7 Million People

18. CyberInsider, Change Healthcare Revises Breach Impact to 192.7 Million Individuals

19. HC Innovation Group, Change Healthcare Tallies 190 Million Data Breach Victims

20. Paubox, Change Healthcare Data Breach: Final Count Reaches 193 Million

21. TechCrunch, AT&T Phone Records Stolen in Data Breach

22. TechCrunch via Yahoo Finance, FBI Says China's Salt Typhoon Hacked at Least 200 US Companies

23. The Record, National Public Data Files for Bankruptcy, Citing Fallout From Cyberattack

24. The Register, National Public Data Files for Bankruptcy, Admits 'Hundreds of Millions' Potentially Affected

25. Emsisoft, Unpacking the MOVEit Breach: Statistics and Analysis

26. CyberScoop, CISA Warns 'Most Serious' Log4j Vulnerability Likely to Affect Hundreds of Millions of Devices

27. The Philadelphia Inquirer (AP), Kaseya Ransomware Attack

28. Business Insurance, DOJ Recovers Most of Ransom Paid by Colonial

29. Security Scientist, A Decade of Data Breaches: What 10 Years of the Verizon DBIR Reveal

30. Security Boulevard (RiskLens), Buried Story of the 2023 Verizon DBIR: Ransomware Stopped Growing

31. TechTarget, Verizon 2023 DBIR: Ransomware Remains Steady but Complicated

32. Cloudflare, 2025 Q4 DDoS Threat Report

33. TechTarget, FBI IC3: Healthcare Sector Leads in Ransomware Attacks

34. Paubox, FBI Names Healthcare the Most Targeted Sector for Ransomware in 2025

35. TechTarget, Average Cost of a Healthcare Data Breach Sits at $9.77M

36. The Record, IBM: Cost of a Breach Reaches Nearly $5 Million

37. Secureframe, Data Breach Statistics and Trends From 2026 Reports

38. Morgan Lewis, Study Finds Average Cost of Data Breaches Significantly Increased Globally in 2024

39. Morgan Lewis, Study Finds Average Cost of Data Breaches Reaches All-Time High in 2022

40. HIPAA Journal, IBM: Average Cost of a Healthcare Data Breach Reaches Record High of $10.1 Million

41. Chainalysis, Total Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate

42. The Record, Ransomware Payments Dropped in 2025 as Attack Numbers Reached Record Levels

43. TechTarget, Chainalysis: 2023 a 'Watershed' Year for Ransomware

44. FBI IC3, 2023 Internet Crime Report

45. SecurityWeek, FBI: Cybercrime Losses Exceeded $12.5 Billion in 2023

46. BankInfoSecurity, CMS Now Says 3.1 Million Affected by MOVEit Hack

47. ITPro, The National Public Data Breach Exposed Nearly Three Billion Records

48. Passwork, 2026 IBM Cost of a Data Breach Report: The $6M AI Threat