US cybercrime losses hit $20.9 billion in 2025

The FBI's annual Internet Crime Report recorded more than one million complaints for the first time, with healthcare and public health experiencing the highest volume of cyber threats across all 16 critical infrastructure sectors.

What happened

Losses reported to the FBI's Internet Crime Complaint Center (IC3) reached $20.9 billion in 2025, a 26 percent increase from $16.6 billion the year prior, according to the FBI's 2025 Internet Crime Report. The IC3 received 1,008,597 complaints, the first time annual complaint volume has exceeded one million in the center's 25-year history. Investment fraud was the largest single driver of losses at $8.6 billion, followed by business email compromise (BEC) at $3 billion and tech support scams at $2.1 billion. Looking at complaint volume, phishing topped the list with 191,561 reports, followed by extortion, investment fraud, personal data breaches, and non-payment and non-delivery schemes. Cyber-enabled fraud appeared in approximately 453,000 complaints and accounted for $17.7 billion of total losses. For the first time, the report included a dedicated section on artificial intelligence-enabled crime, with 22,364 AI-related complaints generating $893 million in losses.

Going deeper

The healthcare and public health sector recorded the highest number of cyber threats among critical infrastructure sectors in 2025, with 182 data breaches and 460 ransomware attacks, ahead of critical manufacturing, financial services, information technology, and government. The IC3 received 3,611 ransomware complaints overall, resulting in more than $32 million in reported losses, a figure that excludes costs for business disruption, equipment damage, and third-party remediation. The five most reported ransomware variants were Akira, Qilin, INC Ransom/Lynx/Sinobi, BianLian, and Play. BEC losses totaled $3 billion across all sectors, sustained by social engineering campaigns that exploit impersonation to authorize fraudulent payments or extract sensitive information. Americans aged 60 and older reported approximately $7.7 billion in total losses, a 37% increase from 2024.

What was said

The FBI's IC3 operations director, Jose Perez, wrote in the report that the center "now averages almost 3,000 complaints per day," a figure that has grown from a few thousand per month when the program launched. The FBI stated that cryptocurrency "remains the preferred method of payment for many fraud schemes because of its perceived anonymity and the difficulty in recovering funds once transferred." The report was released on April 7, 2026.

In the know

The FBI's Financial Fraud Kill Chain (FFKC), a rapid-response mechanism that freezes fraudulent wire transfers when complaints are filed quickly, initiated approximately 3,900 interventions in 2025, successfully freezing more than $679 million in fraudulent transfers at a 58% success rate. The FFKC achieved a 65% success rate specifically for healthcare-related actions. According to CyberScoop, cumulative cybercrime losses over the five years from 2020 to 2025 exceeded $71.3 billion, a nearly 400 percent increase from the $4.2 billion recorded in 2020 alone. The FBI also proactively notified 3,780 victims of cryptocurrency investment fraud through Operation Level Up, finding that 78 percent of those victims were unaware they were being scammed at the time of contact.

The big picture

Healthcare's position at the top of the ransomware victim rankings across all 16 critical infrastructure sectors is consistent with what Paubox has documented in its own breach analysis. According to Paubox's Top 3 Healthcare Email Attacks report, HHS recorded 170 email-related healthcare breaches in 2025 affecting more than 2.5 million individuals, with phishing-driven mailbox takeovers exposing 630,000 individuals and BEC impersonation appearing repeatedly across the most damaging incidents. The FBI's own data, 460 ransomware attacks and 182 data breaches in healthcare alone, confirms that the sector faces an attack volume with no parallel in other industries. IBM puts the average cost of a healthcare data breach at $9.8 million, the highest of any sector tracked. At that figure, 182 data breaches in a single year represent a potential aggregate exposure approaching $1.8 billion in direct breach costs before accounting for disruption to patient care, regulatory penalties, or litigation.

FAQs

What is the Financial Fraud Kill Chain, and how does it help victims?

The FFKC is a rapid intervention process through which the FBI works with financial institutions to freeze fraudulent wire transfers when victims file complaints quickly. Speed of reporting is the single most important factor in whether funds can be recovered, as transfers become much harder to reverse once they clear the recipient institution.

Why does healthcare consistently top ransomware victim rankings?

Healthcare organizations hold data with high extortion value, such as patient records, insurance details, and clinical information, and many operate legacy systems with limited IT security staffing. Ransomware groups target the sector, knowing that operational disruption directly affects patient safety, which creates pressure to pay quickly.

What does the FBI count as an AI-related cybercrime complaint?

AI-related complaints tracked by the IC3 include incidents where scammers used AI tools to forge documents, clone voices, or create deepfake videos to impersonate individuals and defraud victims. The category appeared in the annual report for the first time in 2025, with 22,364 complaints and $893 million in losses.

How significant is BEC as a financial threat compared to ransomware?

BEC losses in 2025 totaled $3 billion, compared to just over $32 million directly attributed to ransomware in IC3 complaints. The gap shows both the volume of BEC attacks and the fact that ransomware losses reported to IC3 exclude business disruption costs, which can dwarf the ransom payment itself.

What should organizations do if they fall victim to a fraudulent wire transfer?

Organizations should contact their financial institution and file a complaint with the IC3 at ic3.gov as quickly as possible. The sooner a complaint is filed, the higher the probability that the FFKC can intervene and freeze the funds before they are moved or converted.