Recommended Free Tools
The strongest 2026 figures point to vulnerability exploitation, ransomware, credential theft and reported online fraud—but they do not add up to a universal count of hacking. The sources summarized here support a useful set of distinct statistics, not a verified inventory of 40 or more. Each measures a different slice of the problem: confirmed breaches, complaints, reported losses or activity detected by a vendor.
What these cybersecurity statistics measure
There is no single global count of hacking in these reports. Verizon’s Data Breach Investigations Report (DBIR) covers security incidents and confirmed breaches in its dataset. The FBI’s Internet Crime Complaint Center (IC3) counts complaints and the losses people report. Microsoft reports activity observed through its products and threat-intelligence environment. Their totals have different units, populations and collection methods, so they should not be added together or treated as competing estimates of the same thing.
As an Amazon Associate I earn from qualifying purchases.
Publication year also differs from the period being measured. Verizon says incidents in its 2026 DBIR occurred from November 1, 2024, through October 31, 2025. The FBI figures below concern its 2025 reporting year and were announced in 2026. Microsoft attaches specific observation windows to some—but not all—of its reported findings.
What the 2026 DBIR says about breaches
The Center for Internet Security (CIS) summarizes Verizon’s 2026 DBIR as covering more than 31,000 security incidents and 22,000 confirmed data breaches across 145 countries. Those are separate counts: not every incident in a dataset is a confirmed breach.
#1 Best Overall
| Reported finding | What it counts |
|---|---|
| 31% | Breaches in which vulnerability exploitation was represented, according to CIS’s 2026 summary of the Verizon DBIR. |
| 13% | Breaches involving credential abuse, according to the same CIS summary. |
| 48% | Breaches in which ransomware was present, according to the same CIS summary. |
| 69% | Ransomware victims who declined to pay, according to the same CIS summary. |
| 48% | Third-party involvement in breaches, according to the same CIS summary; CIS says that involvement grew to this level. |
| 26% | Critical vulnerabilities fully remediated in 2025, according to CIS’s 2026 reporting. |
| 43 days | Median time to resolve critical vulnerabilities, according to CIS’s 2026 reporting. |
These figures describe different aspects of compromise and response. For example, the 31% and 13% figures are shares of breaches, not shares of all cyberattacks. The ransomware payment figure describes victims’ decisions, not the share of incidents that ended without financial loss.
What people reported losing to cybercrime
The FBI says IC3 received 1,008,597 complaints for the 2025 reporting year and recorded nearly $21 billion in reported losses from cyber-enabled crime. These are complaint and reported-loss figures, not a census of every crime or victim. People may not report an incident, and a complaint is not by itself a confirmed finding of criminal activity.
| 2025 IC3 figure | Scope |
|---|---|
| About 453,000 complaints; more than $17.7 billion in reported losses | Cyber-enabled fraud. |
| 181,565 complaints; more than $11 billion in reported losses | Cryptocurrency-related complaints. |
| 22,364 complaints; nearly $893 million in reported losses | Complaints the FBI classified as AI-related. |
| About $7.7 billion in reported losses, up 37% from 2024 | Losses reported by people over 60. |
The categories are not separate totals that can safely be summed: a complaint may fit more than one description. The figures show what reached IC3 and the losses complainants reported, not the full cost of cybercrime across the United States.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What Microsoft observed in its threat environment
Microsoft’s Digital Defense Report 2026 provides vendor telemetry, not a representative count of all attacks worldwide. The figures reflect activity visible to Microsoft products and threat intelligence; some are tied to a stated period or subset of activity.
| Microsoft-reported figure | Observation and scope |
|---|---|
| 52.2% | Of valid-account intrusions involved follow-on credential theft, according to Microsoft’s 2026 report. |
| More than 46 million | Business contact impersonation attacks detected over the 12 months covered by Microsoft’s 2026 report. |
| 25.5% | Of observed cyber threat activity impacted customers in the United States from January 2025 through June 2026, according to Microsoft. |
| More than 145 million | QR-code phishing attacks detected by Microsoft Defender for Office 365 from July 2025 through June 2026. |
| 89–95% | Of email phishing attachments led to a credential-theft effort, according to Microsoft’s 2026 report. |
| 15.8% increase year over year | Ransom detonations against enterprises, as reported by Microsoft in 2026. |
| 78% | Of observed attack techniques against critical infrastructure used cloud identity abuse, according to Microsoft’s 2026 report. |
These are not interchangeable with breach rates: a detected attack need not result in a breach, and activity visible to one provider is not necessarily representative of activity outside that provider’s view. Microsoft does not state a specific measurement window in the summarized findings for every figure, so the report’s publication year should not be mistaken for a uniform observation period.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to interpret the patterns—and reduce exposure
Across these different datasets, the recurring practical themes are exposed vulnerabilities, compromised credentials, social engineering, ransomware and third-party access. The figures suggest where defenders should pay attention, but they do not prove that every organization faces the same mix or that one control will prevent a compromise.
- Patch based on risk and exposure. CIS’s remediation figures indicate that critical vulnerabilities can remain unresolved; prioritize exposed systems and timely fixes.
- Strengthen account security. Credential abuse and follow-on credential theft make multifactor authentication, strong unique credentials and careful account recovery practices relevant defenses.
- Prepare for social engineering. Phishing and impersonation findings support verifying unexpected requests through a separate, trusted channel rather than relying on the message itself.
- Account for third parties. Review supplier access, minimize permissions and include third-party dependencies in incident planning.
- Plan for disruption. Maintain tested backups, practice incident response and know how to isolate affected systems. Verizon’s guidance also includes encryption and regular security testing, while noting that no security strategy is foolproof.
The useful question is not simply how many attacks happen each year. It is what each source counted, during which period, across which population, and whether the number describes attempted activity, confirmed compromise or reported harm.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
