Cybersecurity Statistics 2026: 25+ Sourced Facts & Trends
Cybersecurity headlines move fast, but the underlying numbers move slower and matter more. Below are 25+ statistics pulled directly from primary industry research — IBM's Cost of a Data Breach Report, Verizon's Data Breach Investigations Report (DBIR), Sophos' State of Ransomware, the FBI's Internet Crime Complaint Center (IC3), and Cybersecurity Ventures — covering breach costs, ransomware economics, phishing and AI-driven social engineering, credential attacks, remote-work exposure, and small-business risk.
Every figure below links back to the report or article it came from, so you can verify it yourself rather than take an aggregator's word for it. Some numbers (like average ransom payments) swing year to year, so we've noted the reporting period next to volatile figures.
Key Cybersecurity stats at a glance
- The global average cost of a data breach fell to $4.44 million in 2025 — the first drop in five years — but U.S. breaches still average $10.22 million.
- Ransomware showed up in 44% of breaches in 2025, up from 32% the year before, and hit 88% of small and mid-sized business breaches.
- Stolen credentials remain the top way in, used in 22% of breaches, while AI-generated phishing attacks surged 14x in late 2025.
- Global cybercrime damages are on pace to hit $10.5 trillion in 2025, headed toward $12.2 trillion annually by 2031.
The cost of data breaches & cybercrime
- The global average cost of a data breach fell to $4.44 million in 2025, down 9% from $4.88 million in 2024 — the first year-over-year decline in five years. — IBM
- In the United States specifically, the average breach cost climbed to $10.22 million, driven by regulatory fines and slower detection. — IBM
- Healthcare remains the costliest industry for breaches at $7.42 million per incident on average, even after a drop from $9.77 million the prior year. — IBM
- Organizations now take a mean of 241 days to identify and contain a breach — the fastest pace in nine years, credited to AI-assisted detection. — IBM
- Global cybercrime damages are projected to reach $10.5 trillion in 2025, on a trajectory toward $12.2 trillion annually by 2031. — Cybersecurity Ventures
Ransomware
- Ransomware appeared in 44% of breaches analyzed in the 2025 report, up sharply from 32% a year earlier. — Verizon Data Breach Investigations Report
- Ransomware was involved in 88% of breaches at small and mid-sized businesses, making it the dominant SMB threat. — Verizon DBIR (SMB Snapshot)
- The average cost to recover from a ransomware attack — excluding any ransom paid — dropped to $1.53 million in 2025, down 44% from $2.73 million in 2024. — Sophos, State of Ransomware 2025
- The average ransom payment itself fell to roughly $1 million in 2025, down 50% from about $2 million in 2024. — Sophos, State of Ransomware 2025
- 49% of ransomware victims chose to pay the ransom to get their data back — the second-highest payment rate in six years. — Sophos
Phishing & social engineering
- Phishing was the entry point in 16% of breaches in the 2025 dataset. — Verizon Data Breach Investigations Report
- Stolen credentials remained the single most common initial access vector, used in 22% of breaches. — Verizon Data Breach Investigations Report
- Breaches involving third parties (vendors, contractors, suppliers) doubled year over year, from 15% to 30% of all breaches. — Verizon Data Breach Investigations Report
- Business email compromise (BEC) drove $3.046 billion in reported losses in 2025, across nearly 24,800 complaints. — FBI Internet Crime Complaint Center (IC3)
- AI-generated phishing attacks that slipped past email filters surged roughly 14x in late 2025, jumping from about 4% to 56% of detected attacks over the holiday season. — Hoxhunt
Passwords & credential attacks
- Roughly 193 billion credential-stuffing attempts are logged globally every year. — Akamai (via DeepStrike Password Statistics)
- Credential stuffing accounted for about 19% of authentication attempts observed in SSO logs on a typical day. — Verizon DBIR credential-stuffing research
- 78% of the world's most commonly used passwords can now be cracked in under a second, up from 70% a year earlier. — DeepStrike Password Statistics Report
- Multi-factor authentication (MFA) adoption has reached roughly 70% of enterprise users, though inconsistent enforcement still leaves accounts exposed to credential attacks. — DeepStrike Password Statistics Report
Remote-work risk
- 78% of organizations experienced a remote-work-related security incident in 2025. — StationX, Remote Work Cybersecurity Statistics
- Organizations face an average of roughly 1,000 attempted remote-work-related cyberattacks per month. — StationX, Remote Work Cybersecurity Statistics
- 71% of employees admitted knowingly taking risky actions — clicking suspicious links, sharing credentials, or bypassing security controls. — Proofpoint (via ElectroIQ)
- Human error was a contributing factor in 60% of data breaches in the 2025 dataset. — Verizon Data Breach Investigations Report
Small-business risk & insurance
- Small businesses remain a disproportionate target: roughly 43% of cyberattacks are aimed at small businesses. — StationX, Small Business Cybersecurity Statistics
- Despite the exposure, only about 17% of small businesses carry a dedicated cyber insurance policy. — Small business cyber insurance survey data
📊 Found a stat useful? Cite this page.
These figures are compiled and updated by the Tolodora Editorial Team. You're welcome to use them with a link back to this page:
Tolodora Editorial Team, “Cybersecurity Statistics 2026: 25+ Sourced Facts & Trends”, Tolodora, 2026. https://tolodora.com/blog/cybersecurity-statistics
Frequently asked questions
How much does the average data breach cost in 2026?
IBM's 2025 Cost of a Data Breach Report put the global average at $4.44 million, the first decline in five years, though U.S. breaches averaged a much higher $10.22 million and healthcare breaches averaged $7.42 million. Costs vary heavily by industry, region, and how fast a breach is detected.
Are ransomware attacks getting more or less common?
More common. Verizon's 2025 DBIR found ransomware present in 44% of breaches, up from 32% the year before, and in 88% of breaches at small and mid-sized businesses. At the same time, Sophos found average recovery costs and ransom payments both fell in 2025 compared to 2024, suggesting organizations are recovering faster even as attack frequency rises.
What's the single most common way attackers get in?
Stolen credentials, used in 22% of breaches per Verizon's 2025 DBIR, followed closely by phishing (16% of breaches). Credential stuffing attacks — automated attempts using leaked username/password pairs — now number in the hundreds of billions per year according to Akamai-sourced research.
Is AI making phishing worse?
Yes. Hoxhunt tracked a roughly 14x surge in AI-generated phishing attacks bypassing email filters in late 2025, with their share of detected attacks jumping from about 4% to 56% over the holiday season. The FBI's IC3 also began separately tracking AI-attributed phishing and BEC losses for the first time in its 2025 report.
Why are small businesses especially at risk?
Small businesses are hit by a disproportionate share of attacks (around 43% per aggregated industry research) but under-invest in defenses relative to enterprises — only about 17% carry dedicated cyber insurance, and ransomware shows up in 88% of the breaches they do suffer, per Verizon's SMB-focused DBIR snapshot.
Related on Tolodora
Every figure above is attributed to its cited third-party source and reflects the most recent data we could find at the time of writing; statistics change, so follow the source links to verify. Compiled by the Tolodora Editorial Team — we don't fabricate data.
