Cyber Security Attack Statistics 2026: Trends & Costs
In October 2026, the Inovo InfoSec research team analyzed 20 industry, government, and threat research sources to understand how cyber attack volume, attack types, industry exposure, breach costs, and defensive readiness are changing. Our anchor datasets were IBM's 2026 Cost of a Data Breach Report, which studied breaches at 602 organizations between March 2025 and February 2026,²⁰ Verizon's 2026 Data Breach Investigations Report, which examined more than 22,000 confirmed breaches across 145 countries,¹⁰ the FBI's 2025 Internet Crime Report, which logged 1,008,597 complaints,⁷ the ITRC's 2025 Annual Data Breach Report,⁹ and CISA's Known Exploited Vulnerabilities catalog.¹⁴ We supplemented these with Cloudflare, Sophos, Chainalysis, Gartner, and Munich Re data, and we compared each source against its prior edition to measure change over time. The scope covers data published from 2022 through the first half of 2026, with an emphasis on U.S. organizations.
Cybersecurity Attacks at a Glance
Source: IBM Cost of a Data Breach Reports, 2022 to 2026, via references 1, 4 and 6.
The global average cost of a data breach rose from $4.35 million in 2022⁶ to $4.88 million in 2024,⁴ dipped to $4.44 million in 2025,⁴ and then climbed 12% to a record $4.99 million in 2026.¹˒²⁰
Cyber Attack Volume and Frequency Statistics
The table below presents three years of U.S. breach and cybercrime volume from two independent sources: publicly reported data compromises tracked by the ITRC and cybercrime complaints filed with the FBI.
Table 1: Cyber Attack and Breach Statistics by Year, 2023 to 2025
Year | ITRC data compromises | YoY change | FBI IC3 complaints | YoY change | IC3 reported losses | YoY change |
|---|---|---|---|---|---|---|
2025 | 3,322⁹ | +5%⁹ | 1,008,597⁷ | +17% (calculated) | $20.877B⁷ | +26%⁷ |
2024 | 3,152⁹ | -2% (calculated) | 859,532⁸ | -2% (calculated) | $16.6B⁷ | +33% (calculated) |
2023 | 3,202⁹ | Base year | 880,418¹⁸ | Base year | $12.5B⁷ | Base year |
Note: ITRC counts publicly reported U.S. data compromises, not individual attacks. IC3 counts complaints that victims chose to file, not every incident. Read the two measures side by side; do not add them together.
The data shows that 2025 set records on both measures. The ITRC tracked 3,322 data compromises, the most in its 20-year history and 4% above the prior high of 3,202 in 2023.⁹ FBI complaints passed 1 million for the first time, and reported losses crossed $20 billion.⁷
Our analysis reveals that losses are growing faster than attack counts. Complaints rose 15% from 2023 to 2025, while reported losses rose 67% over the same period.⁷˒¹⁸ In other words, each complaint now carries more financial loss. Cyber-enabled fraud accounted for about 85% of 2025 losses, or $17.7 billion, up from $13.7 billion in 2024.⁷˒⁸ That means fraud accounts for about $4.0 billion of the $4.3 billion year-over-year increase in reported losses (calculated).
Table 2: How Often Attacks Happen, and How Many People Are Affected
This table answers a natural follow-up question: how often do attacks happen in practice, and how many people feel the impact?
Metric | 2024 | 2025 or latest | Change | Source |
|---|---|---|---|---|
FBI IC3 complaints per day | About 2,350 (calculated)⁸ | About 2,760 (calculated)⁷ | +18% (calculated) | FBI IC3 |
FBI IC3 complaints per minute | About 1.6 (calculated)⁸ | About 1.9 (calculated)⁷ | +18% (calculated) | FBI IC3 |
Network-layer DDoS attacks mitigated per day | Not reported | About 128,000 (H1 2026)¹³ | Not comparable | Cloudflare |
U.S. data breach victim notices | 1,367,117,021⁹ | 278,827,933⁹ | -79%⁹ | ITRC |
Complaint rates are calculated from annual IC3 totals (366 days in 2024, 365 in 2025). The FBI describes its current pace as almost 3,000 complaints per day.⁷
The data shows that attack activity runs around the clock. Cloudflare alone mitigated about 5,343 network-layer DDoS attacks per hour in the first half of 2026.¹³ Victim notices fell 79% in 2025 even as compromise counts rose, which the ITRC attributes to the absence of mega-breaches like those in 2024.⁹ Fewer people were notified, but more organizations were breached. The ITRC also found that 70% of 2025 breach notices did not say how the attack happened, up from 45% in 2023.⁹
Cyber Attack Statistics by Type
The table below presents the most common attack types and how often each one shows up. Each source measures attacks differently. Verizon counts the share of confirmed breaches, the FBI counts complaints, and Cloudflare counts blocked traffic events, so the figures are not additive.
Table 3: Share of Breaches and Volume by Attack Type
Attack type | Metric | Value | Basis |
|---|---|---|---|
Ransomware | Share of breaches where ransomware was present | 48%¹⁰ | Verizon 2026 DBIR, all breaches |
Supply chain / third party | Share of breaches with third-party involvement | 48%¹⁰ | Verizon 2026 DBIR, all breaches |
Vulnerability exploitation | Share of breaches by initial access vector | 31%¹⁰ | Verizon 2026 DBIR |
Phishing | Share of breaches by initial access vector | 16%¹⁰ | Verizon 2026 DBIR |
Phishing and spoofing | FBI complaints filed | 191,561⁷ | FBI IC3 2025, complaints |
Credential and identity abuse | Share of breaches by initial access vector | 13%¹⁰ | Verizon 2026 DBIR |
Pretexting (social engineering) | Share of breaches by initial access vector | 6%¹⁰ | Verizon 2026 DBIR |
Malware | Share of manufacturing breaches with malware present | 75%¹² | Verizon 2026 DBIR, manufacturing only |
DDoS | Network-layer attacks mitigated, January to June 2026 | 23.2 million¹³ | Cloudflare network traffic, not breaches |
The data shows that vulnerability exploitation is now the most common way attackers get in. It rose to 31% of breaches, while credential abuse, the previous leader, fell to 13%.¹⁰ Ransomware and third-party involvement each appear in 48% of breaches. In other words, nearly half of all confirmed breaches now involve a vendor, software supplier, or service provider somewhere in the chain.¹⁰
Our analysis reveals that people remain central even as technical attacks grow. Verizon found the human element in 62% of breaches, and phishing remained the most-reported attack type to the FBI by a wide margin.⁷˒¹⁰ Verizon also found that click rates on voice and text phishing tests were 40% higher than on email tests, which signals that attackers are moving beyond the inbox.¹⁰
Table 4: Fastest-Growing Attack Types and Entry Vectors
This table answers the follow-up question: which threats are accelerating, and which ones cost the most when they succeed?
Attack type or vector | Prior period | Current period | Change | Source |
|---|---|---|---|---|
Ransomware losses reported to FBI | $12.5M (2024)⁷ | $32.3M (2025)⁷ | +159% (calculated) | FBI IC3 |
Third-party involvement in breaches | 30% (2025 DBIR)¹¹ | 48% (2026 DBIR)¹⁰ | +60%¹⁰ | Verizon |
Vulnerability exploitation as initial access | 20% (2025 DBIR)¹¹ | 31% (2026 DBIR)¹⁰ | +11 points | Verizon |
Ransomware share of breaches | 44% (2025 DBIR)¹¹ | 48% (2026 DBIR)¹⁰ | +4 points | Verizon |
Vulnerabilities added to CISA KEV catalog | 185 (2024)¹⁴ | 245 (2025)¹⁴ | +32% (calculated) | CISA via SecurityWeek |
Ransomware complaints to FBI | 3,156 (2024)⁷ | 3,611 (2025)⁷ | +14% (calculated) | FBI IC3 |
AI involvement in breaches | 1 in 6 breaches (2025)⁵ | 1 in 4 malicious breaches (2026)²⁰ | +56%²⁰ | IBM |
Average breach cost, phishing as initial vector | Not comparable | $5.29M¹ | 2026 vector breakdown | IBM |
Average breach cost, supply chain compromise | Not comparable | $4.96M¹ | 2026 vector breakdown | IBM |
Note: IBM's 2025 and 2026 AI figures use different bases (all breaches vs. malicious breaches). The 56% growth figure is IBM's own.²⁰
Our analysis reveals that the fastest-growing risks sit outside an organization's own walls. Third-party involvement in breaches jumped 60% in one year, and CISA added 245 actively exploited vulnerabilities to its catalog in 2025, including 24 tied to ransomware groups.¹⁰˒¹⁴ At the same time, AI is now part of one in four malicious breaches, and those AI-enabled breaches cost about $6 million on average, roughly $1 million more than the global average.²⁰
Cyber Attack Statistics by Industry
The table below pairs each sector's average breach cost from IBM with its 2025 U.S. data compromise count from the ITRC. IBM and the ITRC use slightly different sector labels: IBM's "Industrial" is closest to the ITRC's "Manufacturing," and IBM's "Services" is closest to the ITRC's "Professional Services."
Table 5: Attack Frequency and Average Breach Cost by Sector
Sector | Average breach cost (IBM 2026) | Change vs. 2025 | 2025 U.S. compromises (ITRC) | Share of all 3,322 compromises |
|---|---|---|---|---|
Healthcare | $6.64M¹ | -11%¹ | 534⁹ | 16% (calculated) |
Financial services | $6.29M¹ | +13%¹ | 739⁹ | 22% (calculated) |
Industrial / manufacturing | $5.50M¹ | +10%¹ | 299⁹ | 9% (calculated) |
Energy | $5.24M¹ | +8%¹ | Outside ITRC top five | 2% (calculated) |
Services / professional services | $5.08M¹ | +11%¹ | 478⁹ | 14% (calculated) |
Education | $4.15M¹ | +9%¹ | 188⁹ | 6% (calculated) |
Retail | $3.80M¹ | +7%¹ | Outside ITRC top five | 3% (calculated) |
Public sector | $3.50M¹ | +22%¹ | Outside ITRC top five | 5% (calculated) |
The data shows that healthcare remained the costliest industry to breach for the 13th year in a row at $6.64 million, even though it was the only sector whose average cost fell in 2026.¹ Financial services closed most of the gap, rising 13% to $6.29 million.¹ Every other sector IBM tracks saw costs rise, and the public sector had the steepest increase at 22%, though it still has the lowest average cost of the 17 sectors in the study.¹
Our analysis reveals that the most-targeted sector and the most expensive sector are not the same. Financial services had the most U.S. compromises in 2025, while healthcare had the highest cost per breach.¹˒⁹ For manufacturers, Verizon found malware in 75% of breaches and ransomware in 61%.¹²
Table 6: Most-Targeted Industries Ranked by 2025 U.S. Compromises
This table answers the follow-up question: which industries get hit most often, and does frequency line up with cost?
Rank | Industry (ITRC label) | 2025 compromises | Share of 3,322 | Matching IBM average cost |
|---|---|---|---|---|
1 | Financial services | 739⁹ | 22% (calculated) | $6.29M¹ |
2 | Healthcare | 534⁹ | 16% (calculated) | $6.64M¹ |
3 | Professional services | 478⁹ | 14% (calculated) | $5.08M ("Services")¹ |
4 | Manufacturing | 299⁹ | 9% (calculated) | $5.50M ("Industrial")¹ |
5 | Education | 188⁹ | 6% (calculated) | $4.15M¹ |
The data shows that the five most-breached industries account for 67% of all U.S. compromises the ITRC tracked in 2025.⁹ Professional services stands out: the ITRC reports it saw the most significant growth in attacks, in part because a single breached firm can become a stepping stone to many of its clients.⁹
Cost and Impact of Cyber Attacks
The table below presents IBM's average cost of a data breach over three report years, along with how long breaches take to find and contain. IBM's averages blend all company sizes and regions, so they work best as benchmarks rather than forecasts for any single organization.
Table 7: Average Cost of a Data Breach, Detection, and Containment Time
Metric | IBM 2024 | IBM 2025 | IBM 2026 | Change, 2025 to 2026 |
|---|---|---|---|---|
Global average breach cost | $4.88M⁴ | $4.44M⁴ | $4.99M²⁰ | +12%² |
U.S. average breach cost | $9.36M⁴ | $10.22M⁴ | $11.5M¹ | +12.5% (calculated) |
Total days to identify and contain | 258⁵ | 241⁵ | 247¹ | +2.5%² |
Days to identify / days to contain | 194 / 64⁵ | 181 / 60⁵ | 183 / 64³ | Both longer |
Average cost, lifecycle under 200 days | $4.07M⁴ | $3.87M⁴ | $4.32M² | +11.6% (calculated) |
Average cost, lifecycle over 200 days | 5.46M | $5.01M⁴ | $5.65M² | +12.8% (calculated) |
Note: Baker Donelson's summary of the IBM report describes the 2026 U.S. increase as 11%;³ the 12.5% figure is calculated from IBM's published $10.22M and $11.5M averages.
The data shows that breach costs hit a record in 2026, reversing the 2025 decline. The global average rose 12% to $4.99 million, and the U.S. average reached $11.5 million, more than double the global figure.¹ Response times also slipped for the first time in five years: the average breach now takes 247 days to identify and contain, and 183 of those days are spent simply finding it.¹˒³
Our analysis reveals that speed is one of the clearest cost levers in the data. Breaches contained within 200 days cost $4.32 million on average, compared with $5.65 million for breaches that ran longer, a gap of $1.33 million.² That gap narrowed from $1.39 million in 2024 to $1.14 million in 2025, then widened again in 2026 (calculated).⁴˒²¹
Table 8: Ransomware Payouts and Ransomware Exposure by Company Size
This table answers the follow-up question: what do ransomware payments look like today, and does company size change the risk?
Dimension | Metric | Value | Source |
|---|---|---|---|
Ransom payment | Median ransom paid | $139,875 (down from $150,000)¹⁰ | Verizon 2026 DBIR |
Ransom payment | Ransomware victims who did not pay | 69% (up from 64%)¹⁰˒¹¹ | Verizon 2026 and 2025 DBIR |
Ransom payment | Median ransom demand; median payment | $1,324,429; $1.0M¹⁵ | Sophos State of Ransomware 2025 survey |
Ransom payment | Share of victims who paid; total on-chain payments | 28%; about $820M¹⁶ | Chainalysis 2026 Crypto Crime Report, via The Record |
Ransom payment | Ransomware complaints; reported losses | 3,611; $32.3M⁷ | FBI IC3 2025 |
Company size | Ransomware share of SMB breaches vs. large-organization breaches | 88% vs. 39%¹¹ | Verizon 2025 DBIR |
Company size | Confirmed breaches at small and midsize businesses | 7,152¹⁰ | Verizon 2026 DBIR |
Note: Medians differ because the datasets differ. Verizon studies breach cases, Sophos surveys victims, Chainalysis traces cryptocurrency payments, and the FBI counts only what victims report. Verizon's 2026 DBIR gives the prior-year median as $150,000;¹⁰ the 2025 DBIR originally reported $115,000,¹¹ which suggests Verizon restated the prior-year dataset.
The data shows that most ransomware victims now refuse to pay. Verizon found 69% of victims did not pay, and the median payment fell to $139,875.¹⁰ Chainalysis estimates only 28% of victims paid in 2025.¹⁶ Yet company size still shapes exposure: in the 2025 DBIR, ransomware appeared in 88% of small and midsize business breaches versus 39% at large organizations.¹¹ The FBI's $32.3 million in reported ransomware losses reflects only what victims chose to report and excludes lost business, wages, and recovery services, so it understates the true cost.⁷
Cyber Security Defense and Readiness Statistics
The table below presents adoption and impact data for key defenses. Where a named survey reports adoption, we show it. Where it does not, we show the measured result of the control instead.
Table 9: Adoption and Impact of Key Defenses
Defense | Metric | Value | Source |
|---|---|---|---|
AI and automation in security operations | Savings per breach; days cut from the breach lifecycle | $1.93M; 65 days¹ | IBM 2026 |
Vulnerability patching | CISA KEV vulnerabilities fully remediated in 2025 | 26% (down from 38%)¹⁰ | Verizon 2026 DBIR |
Vulnerability patching | Median days to fully remediate | 43 (up from 32)¹⁰ | Verizon 2026 DBIR |
Multifactor authentication (MFA) at vendors | Third parties that fully fixed missing or weak MFA on cloud accounts | 23%¹⁰ | Verizon 2026 DBIR |
Zero trust | Organizations that have implemented it partially or fully | 63%¹⁷ | Gartner survey, Q4 2023 (published April 2024) |
Zero trust | Share of the environment a zero-trust strategy typically covers | Half or less, for most organizations¹⁷ | Gartner survey, Q4 2023 (published April 2024) |
Cyber insurance | C-level respondents who have ever been offered commercial cyber insurance | 52%¹⁹ | Munich Re Global Cyber Risk and Insurance Survey 2026 |
Overall readiness | C-level respondents who say their company is not adequately protected | 89% (up from 81% in 2021)¹⁹ | Munich Re Global Cyber Risk and Insurance Survey 2026 |
Note: Figures come from different surveys and years and should not be compared with one another. Organization-wide MFA, incident response plan, and cyber insurance adoption rates are omitted because we did not find a reliable, named 2025 or 2026 survey figure.
The data shows a wide gap between knowing what works and doing it. Organizations that use security AI and automation extensively paid about $1.93 million less per breach and cut 65 days from the breach lifecycle.¹ Yet only 26% of actively exploited vulnerabilities on CISA's list were fully patched in 2025, and the median time to fix them grew to 43 days.¹⁰ That patching gap lines up directly with Table 3, where exploitation became the leading way attackers get in. Zero trust shows the same pattern: 63% of organizations have implemented it at least partially, but for most, the strategy covers half or less of their environment.¹⁷ And 89% of C-level executives say their company is not adequately protected.¹⁹
Table 10: Time to Detect and Contain a Breach, by Attack Vector
This table answers the follow-up question: how long do breaches take to find, and does the attack vector change that?
Metric | Value | Source | Year |
|---|---|---|---|
Average days to identify a breach | 183³ | IBM | 2026 |
Average days to contain a breach | 64³ | IBM | 2026 |
Total breach lifecycle, all vectors | 247 days¹ | IBM | 2026 |
Breach lifecycle, supply chain compromise | 258 days¹ | IBM | 2026 |
Breach lifecycle, phishing | 251 days¹ | IBM | 2026 |
Our analysis reveals that detection, not containment, is the bottleneck. About three-quarters of the 247-day lifecycle (183 days) is spent finding the breach, and only 64 days are spent containing it once found.³ Supply chain compromises took 258 days, 11 days longer than the 247-day average,¹ which connects back to the 48% third-party involvement rate in Table 3.¹⁰
Cyber Security Attack Statistics: What the 2026 Data Means for Your Security Program
The 2026 data points to four facts that matter for any security budget. Breach costs are at a record $4.99 million globally and $11.5 million in the U.S.²˒²⁰ Unpatched vulnerabilities are now the top way attackers get in.¹⁰ Nearly half of breaches involve a third party.¹⁰ And the average breach goes undetected for six months.³ None of these trends calls for buying more tools first. Each one points back to basic controls, applied in the right order: patch what is actively exploited, hold vendors to the same standard as your own team, enforce MFA, and shorten the time it takes to notice something is wrong.
That is the approach Inovo InfoSec takes with every client. Our CISO-led team starts with a Security Maturity Level Assessment that measures your environment against a proven framework such as NIST, CMMC, SOC 2, or ISO 27001, then builds a prioritized roadmap so effort goes where risk is highest. For defense contractors facing CMMC requirements, and for any organization that relies on an MSP or outside vendors, the third-party and patching findings above are where that work usually begins. If you want to see where your organization stands against these numbers, contact us so our team can help you find out.
References
1. DataBreachCost.com, IBM Cost of a Data Breach Report 2026: Key Findings and Figure Index. https://databreachcost.com/report/2026
2. Baker Donelson, Ten Takeaways from IBM's 2026 Cost of a Data Breach Report. https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report
3. SecureWorld, 2026 Cost of a Data Breach Report: AI Wreaks Havoc on Budgets. https://www.secureworld.io/industry-news/cost-data-breach-report-2026
4. Morgan Lewis, Study Finds Average Cost of Data Breaches Decreased Globally in 2025. https://www.morganlewis.com/ru/blogs/sourcingatmorganlewis/2026/04/study-finds-average-cost-of-data-breaches-decreased-globally-in-2025
5. Northdoor, Cost of a Data Breach Report: 2025 Key Findings. https://www.northdoor.co.uk/insight/news/cost-of-a-data-breach-report-2025/
6. StationX, Average Cost of a Data Breach: 2026 Statistics (IBM historical series). https://app.stationx.net/articles/cost-of-data-breach-statistics
7. FBI Internet Crime Complaint Center, 2025 IC3 Annual Report. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
8. FBI Internet Crime Complaint Center, 2024 Internet Crime Report. https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
9. Identity Theft Resource Center, 2025 Annual Data Breach Report: Record Number of Data Compromises in 2025. https://www.idtheftcenter.org/post/2025-annual-data-breach-report-record-number-compromises/
10. Verizon, 2026 Data Breach Investigations Report: Executive Summary. https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
11. Retarus, Verizon's 2025 DBIR: The State of Play in Cybersecurity. https://www.retarus.com/blog/en/?p=11162
12. Manufacturing.net, Verizon Unveils Latest Data Breach Report. https://www.manufacturing.net/cybersecurity/news/22967240/verizon-unveils-latest-data-breach-report
13. SiliconANGLE, Cloudflare Says 1 Tbps DDoS Attacks Grew Sixfold in the Second Quarter. https://siliconangle.com/2026/08/11/cloudflare-says-1-tbps-ddos-attacks-grew-sixfold-second-quarter/
14. SecurityWeek, CISA KEV Catalog Expanded 20% in 2025, Topping 1,480 Entries. https://www.securityweek.com/cisa-kev-catalog-expanded-20-in-2025-topping-1480-entries/
15. Digital Transactions, Many End Up Paying Ransomware Demands, Though Less Than They Did in Prior Years (Sophos State of Ransomware 2025). https://www.digitaltransactions.net/many-end-up-paying-ransomware-demands-though-less-than-they-did-in-prior-years/
16. The Record (Recorded Future News), Ransomware Payments Dropped in 2025 as Attack Numbers Reached Record Levels: Chainalysis. https://therecord.media/ransomware-payments-chainalysis-cybercrime
17. Gartner, Gartner Survey Reveals 63% of Organizations Worldwide Have Implemented a Zero-Trust Strategy. https://www.gartner.com/en/newsroom/press-releases/2024-04-22-gartner-survey-reveals-63-percent-of-organizations-worldwide-have-implemented-a-zero-trust-strategy
18. FBI Internet Crime Complaint Center, 2023 Internet Crime Report. https://www.ic3.gov/annualreport/reports/2023_ic3report.pdf
19. Risk & Insurance, Executives Say Their Companies Are Not Adequately Protected Against Cyberattacks (Munich Re Global Cyber Risk and Insurance Survey 2026). https://riskandinsurance.com/executives-say-their-companies-are-not-adequately-protected-against-cyberattacks/
20. IBM Newsroom, IBM Study: One in Four Malicious Breaches Are AI-Enabled, Costing Companies $6 Million on Average. https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average
Comments