FBI: Cybercrime Losses Neared $21 Billion in 2025

Losses resulting from cyber-enabled crimes went up 26% year-over-year in 2025, narrowly missing the $21 billion mark, according to the latest annual report from the FBI’s Internet Crime Complaint Center (IC3). Last year, the FBI received 1,008,597 complaints reporting $20.877 billion in losses, up from 860,000 complaints and $16.6 billion in losses reported in 2024. According to the FBI’s report (PDF), nearly one-fifth of the complaints reported phishing/spoofing crimes, with extortion and investment crimes rounding up the top three. When it comes to reported losses, investment crimes took the lead with over $8.6 billion, followed by business email compromise (BEC) at $3 billion, and tech support scams at $2.1 billion. Just over $122 million was reported in losses to extortion crimes. The FBI says cryptocurrency investment fraud was the most lucrative type of crime last year, causing over $7.2 billion in reported losses. Victims are typically approached through texts, social media, ads, or dating apps, are introduced to investment groups claiming to offer guidance, and are enticed to send assets to fake investment scam platforms or apps. “Eventually, when the victims try to withdraw their money, they will be charged taxes and fees as a final attempt to exploit money from the victims before the scammers disappear with all the victims’ funds. Victims are also targeted in recovery scams, claiming to help recover lost funds,” the IC3 report reads. The FBI received over 5.2 million complaints of malicious activity over the past six years, with the total reported losses exceeding $70 billion. The IC3 report also draws attention to cyber threats such as network hijacking, crypto thefts, and corporate espionage, many of which are mounted by state-sponsored threat actors. In 2025, the FBI says, it received numerous complaints regarding data breaches, and botnet, malware, ransomware, and SIM swap attacks. Reported losses to ransomware exceeded $32 million in 2025, with Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, Ransomhub, Lockbit, Dragonforce, Safepay, and Medusa being the top ten variants to hit critical manufacturing, healthcare and public health, and government entities. Related: FBI: $20 Million Losses Caused by 700 ATM Jackpotting Attacks in 2025 Related: Account Takeover Fraud Caused $262 Million in Losses in 2025: FBI Related: Ransomware Losses Climb as AI Pushes Phishing to New Heights Related: The New Rules of Engagement: Matching Agentic Attack Speed WRITTEN BY Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. More from Ionut Arghire Trent AI Emerges From Stealth With $13 Million in Funding Critical Flowise Vulnerability in Attacker Crosshairs GrafanaGhost: Attackers Can Abuse Grafana to Leak Enterprise Data Medusa Ransomware Fast to Exploit Vulnerabilities, Breached Systems German Police Unmask REvil Ransomware Leader Google DeepMind Researchers Map Web Attacks Against AI Agents Guardarian Users Targeted With Malicious Strapi NPM Packages North Korean Hackers Target High-Profile Node.js Maintainers Latest News Data Leakage Vulnerability Patched in OpenSSL RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years Massachusetts Hospital Diverts Ambulances as Cyberattack Causes Disruption  Evasive Masjesu DDoS Botnet Targets IoT Devices Hackers Targeting Ninja Forms Vulnerability That Exposes WordPress Sites to Takeover US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking Iran-Linked Hackers Disrupt US Critical Infrastructure via PLC Attacks Anthropic Unveils ‘Claude Mythos’ – A Cybersecurity Breakthrough That Could Also Supercharge Attacks Trending Webinar: Securing Fragile OT In An Exposed World March 10, 2026 Get a candid look at the current OT threat landscape as we move past "doom and gloom" to discuss the mechanics of modern OT exposure. Register Webinar: Why Automated Pentesting Alone Is Not Enough April 7, 2026 Join our live diagnostic session to expose hidden coverage gaps and shift from flawed tool-level evaluations to a comprehensive, program-level validation discipline. Register People on the Move Pamela McLeod has been named as CISO of the state of New Hampshire. Aspen Digital has named Matt Altomare as its new Senior Director for Cybersecurity Programs. Scott Goree has been appointed Senior Vice President of Channel and Alliances at Delinea. More People On The Move Expert Insights The New Rules Of Engagement: Matching Agentic Attack Speed The cybersecurity response to AI-enabled nation-state threats cannot be incremental. It must be architectural. (Nadir Izrael) The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust Data integrity shouldn’t be seen only through the prism of a technical concern but also as a leadership issue. (Steve Durbin) Why Agentic AI Systems Need Better Governance – Lessons From OpenClaw Agentic AI platforms are shifting from passive recommendation tools to autonomous action-takers with real system access, (Etay Maor) The Human IOC: Why Security Professionals Struggle With Social Vetting Applying SOC-level rigor to the rumors, politics, and 'human intel' can make or break a security team. (Joshua Goldfarb) How To 10x Your Vulnerability Management Program In The Agentic Era The evolution of vulnerability management in the agentic era is characterized by continuous telemetry, contextual prioritization and the ultimate goal of agentic remediation. (Nadir Izrael) Flipboard Reddit Whatsapp Email