Cybercrime Surges in 2025–2026: The Shift from Hacking to "Logging In"
In 2025, the U.S. reported a record $20.9 billion in cybercrime losses up 26% from the previous year marking the first time annual damages exceeded $20 billion. However, the real shift lies not in the scale of theft but in the method: attackers are increasingly bypassing traditional hacking in favor of stolen credentials, AI-driven scams, and trusted third-party vendors. The FBI’s Internet Crime Complaint Center (IC3) logged over 1 million complaints, yet this figure represents only about 25% of actual victims, suggesting the true cost could be several times higher.
Key Trends and Tactics
-
The "Log In, Don’t Break In" Era
- Stolen credentials accounted for 53% of breaches in 2025, with attackers simply signing in as legitimate users. The average breach cost $4.81 million, and detection took 328 days nearly a year of undetected access.
- Social engineering evolved with AI, boosting phishing success rates by 54%. By late 2026, AI-generated phishing is projected to drive 42% of all breaches. Voice phishing ("vishing") alone enabled attacks on Charter, CarGurus, and Crunchbase.
- Ransomware appeared in 44% of breaches (up from 32% in 2024), with half of attacks now skipping encryption to steal and leak data. The average ransomware breach cost $5.08 million, though fewer victims paid (36% in 2025, down from 41%).
-
Supply Chain and Third-Party Risks
- Third-party breaches doubled in 2025, costing $4.91 million per incident. Two U.S. banks Citizens and Frost were compromised on the same day through a shared vendor.
- ShinyHunters, an extortion group, exploited corporate sales software (Salesforce, Microsoft 365) to scrape 1.5 billion records from over 1,000 organizations, including Google, Cisco, and Chanel. Their campaign defined 2026, with the education platform Canvas exposing 275 million records the largest breach in its sector.
-
Industry Impact
- Healthcare remained the costliest target ($11.2 million per breach), driven by high-value medical records and regulatory penalties. Financial services followed at $6.08 million, while manufacturing led in ransomware claims due to production-line disruptions.
- Small businesses were disproportionately hit: 43% of attacks targeted them, with 88% involving ransomware. Only 17% carried cyber insurance, and 60% of breached small firms closed within six months.
-
AI’s Role in Cybercrime
- The IC3 tracked over 22,000 AI-related complaints in 2025, totaling $893 million in losses. Attackers used AI for phishing (37% of cases) and deepfake impersonation (35%). By 2026, AI-driven attacks were projected to account for 16% of all breaches.
Notable Breaches
- France’s ANTS: 11.7 million citizens’ ID records exposed, with permanent damage due to irrevocable biometric data.
- NYC Health + Hospitals: 1.8 million records, including fingerprints, stolen via a third-party vendor.
- Coinbase: 70,000 customers’ data compromised by bribed support agents, costing up to $400 million in remediation.
- Carnival: 6 million customers’ passport details leaked after a socially engineered breach.
Defensive Gaps and Costs
- The global cybersecurity workforce shortage reached 4.8 million in 2025, with budget cuts not talent gaps now the primary cause of understaffing. Breaches in understaffed organizations cost $1.76 million more on average.
- Proactive measures proved effective: A tested incident-response plan cut breach costs by $2.66 million, while AI and automation reduced detection time to 51 days (vs. 241 days industry-wide). Zero trust architecture saved an additional $1.76 million per breach.
- Cyber insurance premiums rose 15–20% in 2026, with ransomware driving 60% of large claims. Only 17% of small businesses carried coverage, leaving them vulnerable to fatal financial losses.
The Bigger Picture
The 2025–2026 data reveals a stark reality: the weakest link is no longer technology but human trust. Attackers are exploiting credentials, AI, and supply chains to bypass defenses, while industries like healthcare and manufacturing face structural risks that even robust security can’t fully mitigate. With global cybercrime costs projected to reach $10.5–$10.8 trillion in 2026, the focus has shifted from preventing breaches to limiting their damage before the data leaves the building.
Source: https://memeburn.com/cybersecurity-data-breach-statistics-2026/
Frost & Sullivan cybersecurity rating report: https://www.rankiteo.com/company/frostandsullivan
Coinbase cybersecurity rating report: https://www.rankiteo.com/company/coinbase
Charter Bank cybersecurity rating report: https://www.rankiteo.com/company/charter-bank
Carnival Corporation cybersecurity rating report: https://www.rankiteo.com/company/carnival-corporation
CHANEL cybersecurity rating report: https://www.rankiteo.com/company/chanel
Google cybersecurity rating report: https://www.rankiteo.com/company/google
First Citizens Bank cybersecurity rating report: https://www.rankiteo.com/company/first-citizens-bank
"id": "FROCOICHACARCHAGOOFIR1782786669",
"linkid": "frostandsullivan, coinbase, charter-bank, carnival-corporation, chanel, google, first-citizens-bank",
"type": "Breach",
"date": "1/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'banking',
'location': 'U.S.',
'name': 'Citizens Bank',
'type': 'financial services'},
{'industry': 'banking',
'location': 'U.S.',
'name': 'Frost Bank',
'type': 'financial services'},
{'industry': 'ISP',
'location': 'U.S.',
'name': 'Charter',
'type': 'telecommunications'},
{'industry': 'automotive',
'location': 'U.S.',
'name': 'CarGurus',
'type': 'e-commerce'},
{'industry': 'data analytics',
'location': 'U.S.',
'name': 'Crunchbase',
'type': 'technology'},
{'industry': 'tech',
'location': 'global',
'name': 'Google',
'size': 'large',
'type': 'technology'},
{'industry': 'networking',
'location': 'global',
'name': 'Cisco',
'size': 'large',
'type': 'technology'},
{'industry': 'luxury goods',
'location': 'global',
'name': 'Chanel',
'size': 'large',
'type': 'retail'},
{'customers_affected': '275 million records exposed',
'industry': 'edtech',
'location': 'U.S.',
'name': 'Canvas',
'type': 'education'},
{'customers_affected': '11.7 million citizens',
'industry': 'public sector',
'location': 'France',
'name': 'ANTS (France)',
'type': 'government'},
{'customers_affected': '1.8 million records',
'industry': 'healthcare',
'location': 'U.S.',
'name': 'NYC Health + Hospitals',
'type': 'healthcare'},
{'customers_affected': '70,000 customers',
'industry': 'cryptocurrency',
'location': 'U.S.',
'name': 'Coinbase',
'size': 'large',
'type': 'financial services'},
{'customers_affected': '6 million customers',
'industry': 'travel',
'location': 'global',
'name': 'Carnival',
'size': 'large',
'type': 'hospitality'}],
'attack_vector': ['stolen credentials',
'AI-driven phishing',
'vishing',
'third-party vendors',
'social engineering'],
'data_breach': {'data_encryption': ['yes (ransomware attacks)'],
'data_exfiltration': ['yes (ShinyHunters, ransomware groups)'],
'number_of_records_exposed': ['1.5 billion (ShinyHunters)',
'275 million (Canvas)',
'11.7 million (ANTS)',
'1.8 million (NYC Health + '
'Hospitals)',
'6 million (Carnival)'],
'personally_identifiable_information': ['yes (ID records, '
'passport details, '
'medical data)'],
'sensitivity_of_data': ['high (biometric, medical, passport)'],
'type_of_data_compromised': ['PII',
'biometric data',
'passport details',
'medical records',
'corporate data']},
'date_publicly_disclosed': '2025-2026',
'description': 'In 2025, the U.S. reported a record $20.9 billion in '
'cybercrime losses, up 26% from the previous year, marking the '
'first time annual damages exceeded $20 billion. Attackers '
'increasingly bypass traditional hacking in favor of stolen '
'credentials, AI-driven scams, and trusted third-party '
'vendors. The FBI’s IC3 logged over 1 million complaints, '
'representing only about 25% of actual victims, suggesting the '
'true cost could be several times higher.',
'impact': {'brand_reputation_impact': ['high (e.g., Google, Cisco, Chanel, '
'Carnival)'],
'data_compromised': ['1.5 billion records (ShinyHunters)',
'275 million records (Canvas)',
'11.7 million ID records (ANTS)',
'1.8 million records (NYC Health + Hospitals)',
'6 million passport details (Carnival)'],
'financial_loss': '$20.9 billion (U.S. in 2025)',
'identity_theft_risk': ['high (biometric data, passport details, '
'PII)'],
'legal_liabilities': ['regulatory penalties (healthcare, financial '
'services)'],
'operational_impact': ['production-line disruptions '
'(manufacturing)',
'healthcare service delays',
'financial transaction interruptions'],
'revenue_loss': ['up to $400 million (Coinbase)'],
'systems_affected': ['Salesforce',
'Microsoft 365',
'corporate sales software',
'healthcare systems',
'financial services']},
'initial_access_broker': {'data_sold_on_dark_web': ['yes (ShinyHunters, '
'ransomware groups)'],
'entry_point': ['stolen credentials',
'third-party vendors',
'social engineering'],
'high_value_targets': ['healthcare',
'financial services',
'manufacturing']},
'lessons_learned': 'The weakest link is no longer technology but human trust. '
'Attackers exploit credentials, AI, and supply chains to '
'bypass defenses. Proactive measures like '
'incident-response plans, AI/automation, and zero trust '
'architecture significantly reduce breach costs and '
'detection times.',
'motivation': ['financial gain', 'data extortion', 'espionage', 'disruption'],
'post_incident_analysis': {'corrective_actions': ['zero trust architecture',
'AI/automation for threat '
'detection',
'incident-response planning',
'third-party risk '
'management'],
'root_causes': ['stolen credentials (53% of '
'breaches)',
'third-party risks (doubled in '
'2025)',
'AI-driven phishing (54% success '
'rate)',
'lack of cybersecurity workforce']},
'ransomware': {'data_encryption': ['yes (50% of ransomware attacks)'],
'data_exfiltration': ['yes (50% of ransomware attacks)'],
'ransom_paid': '36% of victims in 2025 (down from 41%)'},
'recommendations': ['Implement multi-factor authentication (MFA) to mitigate '
'credential theft.',
'Adopt zero trust architecture to limit lateral movement.',
'Test and update incident-response plans regularly.',
'Invest in AI and automation for faster threat detection.',
'Enhance third-party vendor risk management.',
'Increase cybersecurity workforce and budgets to address '
'shortages.',
'Carry cyber insurance, especially for small businesses.'],
'references': [{'source': 'FBI’s Internet Crime Complaint Center (IC3)'},
{'source': 'ShinyHunters campaign data'}],
'regulatory_compliance': {'regulations_violated': ['healthcare regulations '
'(e.g., HIPAA)',
'financial services '
'regulations']},
'response': {'enhanced_monitoring': ['AI and automation (reduced detection '
'time to 51 days)']},
'threat_actor': ['ShinyHunters',
'initial access brokers',
'ransomware groups'],
'title': "Cybercrime Surges in 2025–2026: The Shift from Hacking to 'Logging "
"In'",
'type': ['credential theft',
'ransomware',
'social engineering',
'supply chain attack',
'data breach'],
'vulnerability_exploited': ['weak credential management',
'lack of multi-factor authentication',
'third-party risks',
'AI-generated phishing']}