Computer security spans consumer fraud, identity theft, ransomware, data breaches, vulnerability exploitation and large-scale threat activity. The figures below cover reported events and observed telemetry across the United States, the European Union and global datasets, with each measurement period and population stated.
Key Computer Security Statistics
The most broadly useful computer security figures include:
- 4.2 million internet-crime complaints and $50.5 billion in reported losses were recorded by IC3 worldwide over 2020–2024.
- 859,532 internet-crime complaints were submitted to IC3 in 2024 by its reporting population.
- Cyber-enabled fraud made up 38% of IC3 complaints and 83% of reported losses in 2024.
- 333,981 cyber-enabled-fraud complaints were recorded by IC3 in 2024.
- $13.7 billion in cyber-enabled-fraud losses were reported to IC3 in 2024.
- 6.5 million consumer reports were received by the FTC Consumer Sentinel Network across 29 top categories in the United States in 2024.
- 2.6 million fraud reports and 1.1 million identity-theft reports were recorded by the FTC in the United States in 2024.
- 22% of 845,806 imposter-scam reports to the FTC reported a loss in 2024, totaling $2.952 billion.
- 79% of 118,960 investment-fraud reports to the FTC reported a loss in 2024, totaling $5.697 billion.
- 449,032 credit-card identity-theft reports were recorded by the FTC in the United States in 2024.
- 1,353,175 privacy, data-security and cyber-threat reports were received by the FTC in the United States in 2024.
- 44% of 12,195 Verizon DBIR breaches involved ransomware during the incidents covered by the 2025 report.
- $115,000 was the median ransom paid in Verizon’s ransomware subset for incidents from November 1, 2023, through October 31, 2024.
- 11,079 cybersecurity incidents were observed by ENISA in the European Union from July 2023 through June 2024.
- More than 50% of ENISA’s observed EU events involved DDoS or ransomware during July 2023–June 2024.
- 20% of Verizon DBIR breaches involved vulnerability exploitation, which grew 34% in the 2025 report period.
- More than 600 million cybercriminal and nation-state attacks per day faced Microsoft customers during the telemetry period described in its 2024 report.
- More than 99% of Microsoft’s daily identity attacks were password-based during the Entra telemetry year described in the 2024 report.
Contents
- How large is the reported computer security problem?
- Computer security fraud costs and payment methods
- Identity theft and personal-data statistics
- Ransomware, breaches and recovery outcomes
- Computer security threats and attack paths
- Affected populations and threat activity
How Large Is the Reported Computer Security Problem?
The FBI’s Internet Crime Complaint Center (IC3) recorded 4.2 million complaints and $50.5 billion in reported losses over 2020–2024. This is a global complaint stream received by IC3, not an estimate of total worldwide prevalence, and the figures reflect reported losses.
Source: 2024 IC3 Annual Report.
IC3’s longer series shows more than 9 million complaints received since 2000. In 2024 alone, its reporting population submitted 859,532 complaints, including 263,455 cyber-threat complaints associated with $1.571 billion in reported losses.
- Cyber-enabled fraud represented 333,981 complaints, or 38% of IC3’s 2024 complaint total.
- Cyber-enabled fraud accounted for $13.7 billion, or 83% of all reported IC3 losses in 2024.
- Critical-infrastructure organizations filed 4,878 cyber-threat complaints with IC3 in 2024.
- Phishing and spoofing generated 193,407 IC3 complaints in 2024.
These are observed reports from the IC3 reporting population. Complaints may include duplicates, and they should not be treated as a complete census of victims or attacks.
Computer Security Fraud Costs and Payment Methods
The FTC Consumer Sentinel Network received 6.5 million consumer reports across 29 top categories in the United States in 2024. The FTC describes these as unverified consumer reports rather than survey results, and the system includes partner data.
Source: Consumer Sentinel Network Data Book 2024.
| 2024 FTC measure | Reports or loss | Population and definition |
|---|---|---|
| Fraud reports | 2.6 million | United States consumer reports |
| Identity-theft reports | 1.1 million | United States consumer reports |
| Other reports | 2.8 million | United States consumer reports |
| Imposter scams | 845,806 reports; $2.952 billion lost | 22% reported a loss |
| Investment-related fraud | 118,960 reports; $5.697 billion lost | 79% reported a loss |
| Online shopping and negative reviews | 383,441 reports; $432 million lost | 76% reported a loss |
The median loss among FTC fraud reports with a reported loss was $497 in 2024. Payment channels also show how computer-enabled fraud reaches victims: bank transfers and payments were associated with $2.089 billion in reported losses, while cryptocurrency was associated with $1.417 billion.
Email was the contact method in 25% of FTC fraud reports with a known contact method; 11% of those email-contact reports reported a loss totaling $502 million. Website or app contact represented 12% of reports with a known contact method, and 70% reported a loss.
Identity Theft and Personal-Data Statistics
Credit-card identity theft was the FTC’s largest identity-theft type in 2024, with 449,032 reports. Other identity theft accounted for 358,993 reports, loan-or-lease identity theft for 176,400, and bank-account identity theft for 114,608.
The FTC’s identity-theft dataset also captures overlapping experiences. Fourteen percent of identity-theft reports included more than one identity-theft type, while 86% of 1,135,291 identity-theft reports included usable consumer-age information.
| Identity-theft measure | 2024 United States reports |
|---|---|
| Credit-card identity theft | 449,032 |
| Other identity theft | 358,993 |
| Loan-or-lease identity theft | 176,400 |
| Bank-account identity theft | 114,608 |
| Identity theft with more than one type | 14% |
| Identity theft with usable age information | 86% of 1,135,291 |
Age-linked fraud reports show a different pattern between frequency of loss and size of loss. Among age-identified FTC fraud reports, 44% of reports from people aged 20–29 reported a loss, compared with 24% from people aged 70–79; the median reported loss was $417 for ages 20–29 and $1,000 for ages 70–79.
The FTC received 1,353,175 reports in its privacy, data-security and cyber-threats category in 2024. Tech-support fraud added 78,763 reports, with 51% reporting a loss totaling $80 million.
Ransomware, Breaches and Recovery Outcomes
Verizon’s 2025 Data Breach Investigations Report analyzed 12,195 breaches across 139 countries for incidents from November 1, 2023, through October 31, 2024. Its contributed dataset is global, but it is not a count of every breach worldwide.
Source: Key findings from Verizon’s 2025 Data Breach Investigations Report.
Ransomware appeared in 44% of the breaches in that dataset, up 37% from the prior report, and the median ransom paid was $115,000. Verizon also found that 54% of perimeter-device vulnerabilities were fully remediated in a median of 32 days.
IC3’s 2024 crime-type table recorded 208 ransomware complaints from people aged 60 and over and $12.473 million in ransomware complaint losses. The age figure describes complainants in the IC3 dataset; it does not estimate all ransomware victims aged 60 or older.
IC3’s Recovery Asset Team logged 3,020 financial-fraud complaints involving $848.4 million in attempted theft in 2024. It reported freezing $469.1 million across 2,651 domestic complaints and $92.5 million across 369 international complaints, with a 66% success rate for its intervention process.
Computer Security Threats and Attack Paths
ENISA observed 11,079 publicly reported cybersecurity incidents in the European Union from July 2023 through June 2024. Of these, 322 targeted two or more EU Member States, while DDoS and ransomware together accounted for more than 50% of observed events.
Source: ENISA Threat Landscape 2024.
The EU sector distribution in ENISA’s threat landscape was led by public administration at 19%, followed by transport at 11% and finance at 9%. Ransomware incidents appearing on data-leak sites stabilized around 1,000 claims per quarter by the second quarter of 2024.
ENISA also cited Verizon data showing that phishing and pretexting accounted for 73% of breaches in its social-engineering subset. That subset is narrower than all breaches, so the percentage should not be read as a universal rate for every organization.
Verizon’s 2025 DBIR found that vulnerability exploitation grew 34% and accounted for 20% of breaches. Compromised credentials were an initial access vector in 22% of breaches, while 60% involved a human element.
Affected Populations and Threat Activity
Microsoft’s Digital Defense Report 2024 tracked more than 1,500 unique threat groups in its global threat-intelligence visibility. More than 600 were nation-state groups, 300 were cybercrime groups and 200 were influence-operations groups.
Source: Microsoft Digital Defense Report 2024.
Microsoft said its customers faced more than 600 million cybercriminal and nation-state attacks per day during the preceding telemetry year. Its Entra telemetry showed that password-based attacks made up more than 99% of daily identity attacks, and Microsoft blocked 7,000 password attacks per second over the year covered by the report.
| Observed activity | Measure | Scope |
|---|---|---|
| Threat groups tracked | More than 1,500 | Microsoft global threat-intelligence visibility |
| Nation-state groups | More than 600 | Microsoft 2024 inventory |
| Cybercrime groups | 300 | Microsoft 2024 inventory |
| Influence-operations groups | 200 | Microsoft 2024 inventory |
| Attacks faced per day | More than 600 million | Microsoft customers globally |
| Blocked password attacks | 7,000 per second | Microsoft telemetry, 2023–2024 report window |
Verizon’s contributed global dataset adds a supply-chain dimension: third-party involvement doubled from 15% to 30% of breaches between the prior report and its 2025 DBIR. Across these sources, the measurements describe distinct observability systems—consumer reports, public incident reporting, contributed breach records and vendor telemetry—so they should be compared as indicators of computer-security exposure, not combined into a single global total.