Cybersecurity Statistics : Facts And Figures 2025

Jeffrey

53 minutes ago

Introduction

Cybersecurity Statistics: In today’s digital age, the threat of cyber-attacks is more pressing than ever. In the third quarter of 2024, organizations worldwide faced an average of 1,876 cyber-attacks per week, marking a 75% increase from the same period in 2023.

The financial implications are staggering. In 2023, cybercrime losses reached a record $12.5 billion, and projections indicate this figure could soar to $13.82 trillion by 2028. Certain sectors are particularly vulnerable. The education and research sector experienced an average of 3,828 weekly attacks, while the government and military sectors faced 2,553 attacks per week.

Geographically, Africa bore the brunt, with organizations encountering 3,370 attacks per week, a 90% increase from the previous year. Europe and Latin America also saw significant rises, underscoring the global nature of this threat. Ransomware remains a persistent menace, with over 1,230 incidents reported in 2024. North America was the most affected, accounting for 57% of these incidents, followed by Europe at 24%.

Editor’s Choice

Cyberattack Statistics & Global Impact

In 2023, there were 2,365 cyberattacks, affecting a staggering 343,338,964 victims worldwide.
The COVID-19 pandemic triggered a 600% rise in cybercrime, marking an unprecedented increase in digital threats.
Ransomware remains dominant, accounting for over 72% of cybersecurity incidents in 2023, and is expected to continue in 2024.
Between January and June 2024, IoT malware attacks increased by 107% compared to the same period in 2023.

Financial Cost of Cybercrime

In 2024, the average cost of a data breach reached $4.88 million, highlighting the financial burden of weak cybersecurity measures.
Cybercrime is expected to cost the global economy $9.5 trillion in 2024, slightly below previous projections.
By 2025, the worldwide cost of cybercrime is projected to reach $10.5 trillion annually, reflecting a 15% annual growth rate.
Cybercrime expenses now account for 1% of global GDP, emphasizing the severity of digital threats.
Security-driven AI significantly reduced financial damage, saving companies up to $3.81 million per breach—an 80% difference in mitigation costs.
Zero-trust security policies helped businesses cut breach-related expenses by $1.76 million per incident.

Cybersecurity Market & Employment Growth

The global cybersecurity market is projected to reach $300 billion in 2024, driven by increased investments in security solutions.
The demand for cybersecurity professionals is skyrocketing, with information security jobs expected to grow by 32% between 2022 and 2032.

Key Cyber Threats & Attack Trends

Phishing remains a major concern, contributing to over 40% of social engineering attacks in 2024.
Cloud systems have become prime targets, with attacks increasing by 75% between 2023 and 2024.
Small businesses (1–250 employees) are the primary targets for malicious emails, indicating a need for stronger security awareness and training.
Cyber extortion affects large companies the most (40%), followed by small businesses (25%) and mid-sized firms (23%).
Internal employees (both intentional and unintentional) are responsible for 37.45% of security breaches, underlining the importance of internal security training.

Regional Impact of Cybercrime

Europe was the top target of hacktivist attacks (85%), followed by North America (7%) and the Middle East (3%).

Recent Major Data Breaches & Cyber Attacks

The rising number of cyberattacks has exposed millions of users’ personal information, affecting companies across industries. Below is a breakdown of some of the biggest breaches and their impact.

One of the most extensive breaches occurred with the National Public Data (NPD), where personal information of approximately 2.9 billion individuals was compromised, including sensitive details such as Social Security numbers and physical addresses. This incident highlights the profound impact of cyber threats on personal privacy.
The healthcare sector was not spared, with multiple breaches reported across various organizations. For example, Perry Johnson & Associates reported a breach affecting over 13 million individuals, demonstrating the vulnerability of healthcare data to cyber-attacks.
Additionally, the corporate sector witnessed the Mother of All Breaches (MOAB), a massive compilation of data from various sources, affecting over 26 billion records. This breach included data from platforms like LinkedIn and Twitter, showcasing the broad reach and severe consequences of such incidents.
Telecommunications also faced dire challenges, with an unprecedented breach in India impacting 750 million users. This incident revealed sensitive personal information and underscored the need for robust cybersecurity measures in protecting user data.
560 million Ticketmaster customers had their personal data stolen in a 2024 breach. This massive leak raises concerns about security in the entertainment and ticketing industry.
A 2021 LinkedIn data breach exposed the personal details of 700 million users – approximately 93% of all LinkedIn members. This highlights the vulnerability of professional networking platforms.
Microsoft suffered a cyberattack in March 2021, impacting more than 30,000 organizations across the U.S., including businesses and government agencies. This attack demonstrated the risk even major tech firms face.
A security vulnerability, left undiscovered for two years, led to the exposure of over 533 million users’ personal information in April 2021. This breach underscores the long-term risks of overlooked cybersecurity flaws.
Using just one password, hackers infiltrated Colonial Pipeline in 2021, executing a ransomware attack that caused nationwide fuel shortages across the U.S. This attack highlighted the risks to critical infrastructure.
The world’s largest meat processing company, JBS, faced a ransomware attack that shut down beef and poultry plants across four continents. The attack exposed the vulnerability of food supply chains.
T-Mobile suffered two major breaches in 2023. The first attack compromised 37 million customers’ data, while the second exposed the personal details of 836 customers. Repeated incidents raise questions about telecom security.
Luxury retailer Neiman Marcus discovered a data breach in September 2021, which had been ongoing for 18 months, exposing 4.6 million shoppers’ payment data and personal information.
A 2021 cloud misconfiguration led to a massive Android data leak, exposing personal details of over 100 million users. This incident revealed the risks of improper cloud storage management.
Robinhood, the popular trading app, suffered a social engineering attack that compromised the data of 5 million users. This attack showed how human error remains a major cybersecurity risk.

Top 5 Countries with the Most Cybercrime

USA: Just over 2.5 billion attacks.
Russia: About 2.5 billion attacks.
China: Approximately 1.5 billion attacks.
France: Slightly less than 1 billion attacks.
Germany: Close to 0.5 billion attacks.

Cybersecurity Attack Statistics

Ransomware Statistics

Ransomware is a type of malicious software that encrypts a victim’s data, with attackers demanding payment for decryption. In 2024, the average ransom demand per attack exceeded $5.2 million, with some payments reaching record amounts, such as a $75 million payout in March 2024.

The healthcare sector has been particularly hard-hit. In 2024, ransomware attacks on healthcare organizations reached a record high, surpassing levels from the previous four years. Recovery times have also lengthened, with only 22% of affected entities restoring operations within a week, down from 47% in 2023.

Ransomware Stats	2024	2023
Number of attacks	936	1,424
Average ransom demand	$3.7 million	$4.4 million
Total records affected	182 million	241 million
Top ransomware strain	LockBit (77 attacks)	LockBit (221 attacks)

Source: techopedia.com

Ransomware attacks have surged in both frequency and financial impact in 2023. Organizations across industries are facing significant challenges as cybercriminals continue to exploit vulnerabilities at an alarming rate.

The average ransom demand in 2023 reached $1.54 million, nearly double the $812,380 recorded in 2022. This sharp rise highlights the growing financial burden on businesses.
When looking at the root cause of ransomware incidents, 36% of victims reported that an exploited vulnerability was the primary entry point. Meanwhile, 29% of attacks stemmed from compromised credentials.
Ransomware tactics have also evolved. More than 75% of attacks now involve data encryption, forcing organizations into difficult negotiations or costly recovery efforts.
The business impact of ransomware is severe. Nearly 85% of private-sector organizations reported losing business or revenue due to these attacks. This emphasizes how cybersecurity incidents directly affect financial stability and customer trust.
On a global scale, ransomware has become a widespread threat. In 2023, 72.7% of organizations worldwide reported experiencing at least one ransomware attack. This shows that no industry or region is immune to the growing cyber risks.
The financial toll goes beyond just paying a ransom. The average cost of recovery from a ransomware attack in 2023 was $1.82 million, excluding any ransom payments. This includes downtime, operational disruptions, and remediation expenses.
The total financial impact of a ransomware attack, including recovery and ransom costs, reached a staggering $4.54 million on average in 2023. This highlights the urgent need for stronger cybersecurity measures and proactive defense strategies.

Phishing Statistics

Phishing involves deceptive attempts to obtain sensitive information by masquerading as trustworthy entities. In the third quarter of 2024, there were 932,923 phishing attacks, up from 877,536 in the previous quarter. A significant majority of these attacks – 96% – are delivered via email, making it the primary vector for phishing attempts.

Phishing attacks come in several forms, each tailored to deceive victims in different ways. Here are the four main types of phishing that cybercriminals use:

Spear Phishing – This is a highly targeted attack where hackers send personalized messages via email, text, or phone to trick individuals into revealing sensitive data. Attackers often gather details from social media, data breaches, or public records to make their messages seem more legitimate.
Whaling – Unlike general phishing, whaling focuses on high-profile executives such as CEOs, CFOs, and directors. These attacks are highly customized, often impersonating business partners or government agencies to steal financial information or gain access to corporate systems.
Vishing (Voice Phishing) – This type of phishing occurs over the phone. Attackers call victims, pretending to be from banks, tech support, or government agencies, aiming to steal banking credentials, credit card information, or personal data. With AI-generated voices becoming more sophisticated, vishing attacks have become even harder to detect.
Email Phishing – The most common form of phishing, where attackers send fake emails impersonating trusted organizations (e.g., banks, government agencies, or tech companies). These emails often contain malicious links leading to fake websites designed to steal login credentials or financial information.

Phishing is not just a widespread cyber threat—it is the leading entry point for account takeover (ATO) attacks. Research shows that 74% of ATO attacks begin with phishing, where cybercriminals trick users into revealing login credentials, allowing them to access sensitive accounts.

Top Companies Targeted by Phishing Scams

Cybercriminals focus their phishing efforts on popular brands that people trust. Here are the most frequently targeted companies:

Source: techopedia.com

Malware

Malware, short for malicious software, encompasses a range of harmful programs designed to infiltrate and damage computer systems without user consent. These include viruses, worms, ransomware, spyware, and trojans, each posing unique threats to individuals and organizations.

In 2024, the cybersecurity landscape witnessed a significant surge in malware activity. The AV-TEST Institute reported over 60 million new malware strains detected throughout the year, averaging more than 300,000 new threats daily.

Ransomware attacks, a particularly damaging form of malware, have escalated alarmingly. Research indicates a 71% increase in ransomware incidents, with global losses reaching $20 billion in 2022 and projections suggesting costs could rise to $265 billion by 2031.

The methods of malware delivery have also evolved. A significant portion of malware—92%—is distributed via email, often through phishing campaigns that trick recipients into clicking malicious links or downloading infected attachments.

Geographically, the United States remains a primary target, experiencing approximately 2.7 billion malware attacks in 2022. However, regions like Europe, Latin America, and Asia have seen notable increases in attack volumes, highlighting the global nature of the threat.

Distributed Denial of Service (DDoS)

In recent years, Distributed Denial of Service (DDoS) attacks have escalated both in frequency and intensity, posing significant challenges to organizations worldwide.

Surge in Attack Volume

In the first half of 2024, DDoS attacks surged by 46% compared to the same period in 2023, totaling 445,000 incidents in the second quarter alone.

Escalation in Attack Magnitude

The scale of these attacks has reached unprecedented levels. In October 2024, a record-breaking DDoS attack peaked at 4.2 terabits per second (Tbps), underscoring the growing capabilities of cyber adversaries.

Targeted Industries and Geographies

The Banking & Financial Services sector has become a primary target for DDoS attacks. Geographically, China experienced the highest number of attacks in the third quarter of 2024, followed by the United Arab Emirates and Hong Kong.

Emerging Tactics

Cybercriminals are adopting new strategies, such as ransom-driven DDoS attacks, where they demand payment to cease their disruptive activities. Additionally, politically motivated groups, or hacktivists, are leveraging DDoS attacks to advance ideological agendas.

Mitigation and Defense

To combat the evolving DDoS threat landscape, organizations must implement robust cybersecurity measures. This includes deploying advanced DDoS mitigation solutions, conducting regular security assessments, and developing comprehensive incident response plans to ensure resilience against these increasingly sophisticated attacks.